t-mobile[.]kiwjz[.]cc

Analysis of the domain t-mobile.kiwjz.cc indicates a brand impersonation phishing campaign targeting users of X.com (formerly Twitter). The domain, registered on February 21, 2026, through Gname.com Pte. Ltd., resolves to the IP address 172.67.210.110, which is associated with Cloudflare, Inc. (AS13335) and geolocated in the United States. At the time of assessment, the domain displayed an HTTP response with the page title 'Welcome to nginx!', suggesting either a misconfigured or placeholder server setup, or an attempt to evade detection by presenting a benign default page. No SSL certificate was observed, increasing the likelihood of interception or manipulation of user data if the site were operational.

Detection metrics reveal elevated risk: 11 of 93 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist, as tracked by PhishDestroy. The domain has since been taken offline, though its infrastructure remains a potential vector for future campaigns. The use of Cloudflare nameservers (merlin.ns.cloudflare.com and rafe.ns.cloudflare.com) is consistent with threat actors leveraging content delivery networks to obscure hosting origins and complicate takedown efforts. For defenders, this domain presents several actionable indicators.

The IP address 172.67.210.110, registrar Gname.com Pte. Ltd., and Cloudflare nameservers should be monitored for additional malicious domains. The absence of an SSL certificate, combined with the 'Welcome to nginx!' page title, may serve as a heuristic for identifying similar campaigns. While the exact phishing kit or payload is not confirmed, the domain's association with X.com brand impersonation warrants inclusion in blocklists and real-time monitoring systems. Given the domain's offline status, further forensic analysis of its historical activity is recommended to identify any secondary payloads or infrastructure reuse.