t-mobile[.]rnvdua[.]cc

The domain t-mobile.rnvdua.cc was registered on February 21, 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare infrastructure (AS13335) with the IP address 172.67.156.172 located in the United States. DNS resolution points to Cloudflare nameservers amalia.ns.cloudflare.com and elliott.ns.cloudflare.com. No TLS certificate is presented, and the HTTP response returns the default page title "Welcome to nginx!", indicating that a generic web server placeholder is being served rather than a brand‑specific landing page. The site was classified as a brand impersonation campaign targeting x.com, and security vendors have recorded 12 detections out of 93 scans on VirusTotal.

Independent analysis by PhishDestroy has resulted in the domain being blocked, and it appears on a single external blocklist. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious reputation. The current status is offline, which limits direct observation of payloads or credential‑stealing forms, leaving the precise content and phishing kit unknown. Despite the offline state, the observed infrastructure—Cloudflare edge nodes, lack of SSL, and the generic nginx page—matches patterns used in transient phishing deployments that rely on rapid domain turnover.

Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any re‑registration or re‑activation of the same second‑level domain or similar subdomains under the rnvdua.cc zone. Threat intelligence feeds should be enriched with the registrar, creation date, and IP details to aid correlation with future observations. Continuous re‑scanning of the domain, should it become reachable again, is recommended to capture any evolving payloads or credential‑harvesting pages that may be deployed in subsequent campaign stages.