t-mobile[.]mvbgp[.]cc

This domain is flagged as an elevated-risk brand impersonation threat designed to deceive users of X.com. Analysis indicates the infrastructure is specifically engineered to mimic the legitimate platform, likely for credential theft or unauthorized account access. The domain exhibits multiple indicators of malicious intent, including its recent creation and association with known phishing tactics. Infrastructure analysis reveals the domain t-mobile.mvbgp.cc was registered on January 28, 2026, through Gname.com Pte. Ltd. It resolves to the IP address 172.67.192.25, hosted on Cloudflare’s network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend superficial legitimacy. Security vendors on VirusTotal flagged the domain 16 out of 95 times, and it appears on at least one security blocklist, specifically PhishDestroy. The page title, 'Welcome to nginx!', suggests a generic or misconfigured server setup, often seen in hastily deployed phishing infrastructure. Mitigation steps for this brand impersonation threat include immediately blocking the domain and its associated IP address across network security controls. Users who may have interacted with the domain should reset credentials for X.com and any linked accounts, particularly if multi-factor authentication was not enabled. Security teams should monitor for additional domains registered through the same registrar or resolving to the same IP range, as threat actors frequently reuse infrastructure. Organizations should also educate users on identifying brand impersonation tactics, such as scrutinizing domain names for slight misspellings or unusual subdomains.