t-mobile[.]toemd[.]cc

The domain t-mobile.toemd.cc has been identified as a threat due to brand impersonation activities targeting x.com. This domain presents an elevated risk level as it attempts to deceive users by mimicking a legitimate brand. The site was observed with the page title 'Welcome to nginx!', suggesting a placeholder page that may have been used during the phishing campaign.

Technical indicators for this domain include detection by 13 out of 95 security vendors on VirusTotal, highlighting its malicious nature. Registered through Gname.com Pte. Ltd., the domain was created on February 21, 2026. It resolves to the IP address 104.21.59.24, associated with AS13335, Cloudflare, Inc., located in the United States. The domain does not have an SSL certificate and has been listed on one security blocklist, specifically blocked by PhishDestroy.

Currently, the domain t-mobile.toemd.cc is offline, mitigating the immediate risk of brand impersonation. However, the initial detection and blocklisting indicate that it was actively used for malicious purposes before takedown. Continued monitoring for any reactivation or similar domain registrations is recommended to prevent further impersonation attempts. Security measures such as updating blocklists and educating users about phishing threats are advised to reduce future risks.