t-mobile[.]iyebo[.]cc

Analysis of the domain t-mobile.iyebo.cc indicates a confirmed brand impersonation campaign targeting x.com, classified as elevated risk. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with fraudulent infrastructure. Infrastructure analysis reveals Cloudflare-hosted nameservers (clara.ns.cloudflare.com and jerry.ns.cloudflare.com) and resolution to IP address 172.67.145.166, which belongs to AS13335 Cloudflare, Inc. in the United States. No SSL certificate was detected, increasing the likelihood of interception or tampering during data transmission.

The domain appears on one security blocklist and is actively blocked by PhishDestroy. While the page title 'Welcome to nginx!' suggests a default server configuration—common in hastily deployed phishing kits—the exact content remains unanalyzed. VirusTotal reports flagged the domain by 10 of 93 security vendors, providing further evidence of malicious intent. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk.

As of July 23, 2026, the domain is offline, though defenders should treat it as a persistent threat vector. Organizations are advised to block the domain and associated IP at the perimeter, monitor for related infrastructure (e.g., subdomains, newly registered lookalikes), and alert users to the impersonation of x.com. Given the use of Cloudflare, additional obfuscation techniques may be employed to evade detection. No evidence of a specific phishing kit or payload is currently available, but the combination of brand impersonation, lack of SSL, and detection by multiple vendors warrants immediate action.