t-mobile[.]hedsy[.]cc

This domain, t-mobile.hedsy.cc, is identified as a high-risk brand impersonation phishing site targeting X.com (formerly Twitter). Analysis indicates the domain was configured to mimic legitimate X.com authentication portals, likely to harvest user credentials or facilitate unauthorized account access. No explicit crypto drainer kit signatures were observed, but the infrastructure aligns with credential theft campaigns. The page title 'Welcome to nginx!' suggests a default server configuration, often indicative of hastily deployed phishing infrastructure or misconfigured malicious servers. Technical indicators confirm the domain's malicious classification. VirusTotal reports 20 out of 95 security vendors flagging t-mobile.hedsy.cc as phishing, while Google Safe Browsing explicitly labels it as a phishing threat. The domain was registered through Gname.com Pte. Ltd. on February 21, 2026, and resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors to lend false legitimacy. The domain appears on one additional security blocklist, reinforcing its malicious classification. As of the latest verification, t-mobile.hedsy.cc has been taken offline, likely due to remediation efforts by hosting providers or domain registrars. However, residual risk persists due to the domain's recent registration and the potential for infrastructure reuse. Organizations and users are advised to block the domain and associated IP address at the network level. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range, as threat actors often redeploy infrastructure. Credential reset protocols should be enforced for any users who may have interacted with the domain prior to its takedown.