t-mobile[.]bufcn[.]cc

This domain is flagged as an elevated-risk brand impersonation threat designed to deceive users into believing it is affiliated with X.com. The infrastructure mimics legitimate services to facilitate credential theft or unauthorized account access, a tactic commonly observed in targeted phishing campaigns against social media platforms. Analysis indicates the domain t-mobile.bufcn.cc was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with abusive domain registrations. It resolves to the IP address 104.21.96.150, hosted on Cloudflare’s network (AS13335), which is often leveraged to obscure malicious infrastructure. The domain lacks an SSL certificate, increasing the risk of unencrypted data interception. Security vendors on VirusTotal flagged it 17 out of 95 times, and it appears on at least one security blocklist. The page title, 'Welcome to nginx!', suggests a default server configuration, often indicative of hastily deployed phishing infrastructure. To mitigate risks associated with this brand impersonation threat, users should avoid clicking links or entering credentials on t-mobile.bufcn.cc. Organizations should implement DNS-based blocking for the domain and its resolving IP address. Security teams are advised to monitor for similar patterns, such as newly registered domains using Cloudflare hosting or default server banners, which are common in phishing campaigns. If credentials were entered on this domain, immediate password resets and multi-factor authentication enforcement are recommended for the affected X.com account.