t-mobile[.]ornbu[.]cc

The domain t-mobile.ornbu.cc was registered on February 21, 2026 through Gname.com Pte. Ltd. and resolves to the IP address 188.114.97.3, which belongs to Cloudflare (AS13335) and is geolocated in the United States. The authoritative nameservers maleah.ns.cloudflare.com and rocky.ns.cloudflare.com confirm that the domain is hosted behind Cloudflare’s edge network. No TLS certificate is presented; the site responds without HTTPS, exposing the connection to interception. The HTTP response includes the default page title "Welcome to nginx!", indicating that no custom landing page is currently served.

The site is flagged as a brand impersonation campaign targeting the brand x.com, although the page content has not been captured for further analysis. Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal analysis shows that 12 of 93 scanning engines have flagged the domain as malicious, and it appears on at least one external blocklist. PhishDestroy has already taken the domain offline, and the current status is reported as taken offline.

The combination of a recent registration, Cloudflare hosting, lack of SSL, low trust score, and vendor detections suggests a deliberate attempt to abuse the x.com brand for credential harvesting or other fraudulent activity. Defenders should block DNS resolution for t-mobile.ornbu.cc at the network perimeter, add the domain to URL filtering policies, and monitor for any related indicators of compromise that reference the same IP address or Cloudflare nameservers. Threat intelligence feeds should be updated with the domain’s creation date, hosting details, and the observed vendor detections to improve correlation with future campaigns.