t-mobile[.]whsgj[.]cc

The domain t-mobile.whsgj.cc, which impersonates x.com, has been taken offline. Despite its current status, it was flagged as malicious by 15 out of 93 vendors on VirusTotal. PhishDestroy detected this domain on January 24, 2026, shortly after its creation on January 22, 2026. This quick detection highlights the efficiency of PhishDestroy's threat intelligence pipeline.

The domain was registered through Gname.com Pte. Ltd. and hosted on an IP address managed by Cloudflare, Inc., located in the United States. The page displayed a generic 'Welcome to nginx!' message, which is often a placeholder for phishing sites under development or awaiting further configuration. The lack of an SSL certificate further indicates its illegitimacy.

This domain's impersonation of x.com is a typical tactic used in phishing schemes to deceive users into divulging sensitive information. The presence of the brand x.com on the page confirms the intent to mislead visitors. Although the site is now offline, its brief operational period underscores the importance of rapid detection and response in mitigating phishing threats. The domain's inclusion in PhishDestroy's blocklist and its low platform risk score of 10/100 reflect its limited impact before being neutralized.