t-mobile[.]viflcbc[.]cc

The domain t-mobile.viflcbc.cc was registered on February 21, 2026 through Gname.com Pte. Ltd. and is currently taken offline. Infrastructure analysis shows the domain resolves to the IP address 172.67.211.197, which belongs to the Cloudflare network (ASN 13335) and is geolocated to the United States. Both authoritative nameservers, matteo.ns.cloudflare.com and sydney.ns.cloudflare.com, are Cloudflare‑provided, indicating the attacker leveraged a reputable CDN to mask the true origin of the host. No TLS certificate is presented, and HTTP requests return the default "Welcome to nginx!" page title, suggesting the site was either a placeholder or a minimal web server without custom content.

The domain is listed on a single public blocklist, PhishDestroy, and has a Gridinsoft trust score of 0 out of 100, reflecting an extreme lack of reputation. VirusTotal scans flagged the domain by 11 of 93 security vendors, reinforcing the suspicion of malicious intent. The campaign is classified as a brand impersonation targeting x.com, although the landing page content has not been captured and therefore the exact phishing vector remains unknown.

Defenders should block DNS resolution to the domain and any associated IP ranges, monitor for outbound connections to the Cloudflare‑hosted IP, and update URL filtering rules to include t‑mobile.viflcbc.cc. Continuous observation of the domain’s status is advised, as offline hosts can be re‑activated quickly. Threat intelligence sharing with upstream providers and inclusion in internal blocklists will help mitigate potential re‑use of the infrastructure for future impersonation attempts.