t-mobile[.]zgmif[.]cc

t-mobile.zgmif.cc was observed hosting a brand‑impersonation campaign targeting the x.com brand. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and is delegated to Cloudflare nameservers rosa.ns.cloudflare.com and seamus.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. No TLS certificate is presented; HTTP connections return the default nginx page with the title “Welcome to nginx!”, indicating that the site is not serving the expected brand‑specific content.

The Gridinsoft trust‑score for the domain is 0 out of 100, reflecting an extremely low reputation. Ten of the ninety‑five vendors on VirusTotal flagged the domain as malicious, and the domain appears on at least one public blocklist, specifically PhishDestroy, confirming its inclusion in security‑focused blocklists. The site’s current status is recorded as offline, suggesting that the malicious content may have been removed or the hosting has been taken down, but the infrastructure artifacts remain observable. Evidence is limited to passive DNS and reputation data; no active content analysis has been published, so the exact phishing payload or credential‑capture mechanisms cannot be confirmed.

Defenders should continue to block the domain at network perimeters, update URL filtering policies to include the observed IP address and Cloudflare nameservers, and monitor for any re‑registration or re‑use of the same sub‑domain pattern. Because the domain resolves to a shared Cloudflare IP, additional scrutiny of other Cloudflare‑hosted assets that resolve to the same address may be warranted. Continuous re‑scanning with multi‑vendor engines is recommended to capture any future changes in detection status.