t-mobile[.]uyizk[.]cc

The domain t-mobile.uyizk.cc is identified as a phishing infrastructure component specifically designed to impersonate X.com (formerly Twitter), a high-profile social media platform. Analysis confirms this domain operates under the threat classification of brand impersonation, with the primary objective of harvesting user credentials through deceptive login portals. As of the latest verification, the domain has been taken offline, though prior activity and infrastructure remain documented for forensic purposes. Technical indicators reveal the domain was registered on February 21, 2026, an anomalous future date suggesting potential data manipulation or registrar error. It resolves to the IP address 104.21.70.66, hosted on Cloudflare's network (AS13335), a common obfuscation tactic used to conceal malicious origins. Detection metrics show the domain is flagged by 17 of 95 security vendors on VirusTotal, while appearing on a single security blocklist. The SSL certificate, identified as WE1, lacks transparency and does not align with standard issuing authorities. The observed page title, 'Welcome to nginx!', indicates a misconfigured or placeholder server deployment, which may precede the activation of a fully operational phishing kit. Current risk assessment categorizes this domain as elevated due to its association with a widely targeted brand and the use of infrastructure known for abuse. While offline, the domain's registration and resolution history warrant continued monitoring. Organizations and users are advised to implement DNS-based blocking for the domain and IP address 104.21.70.66, enforce multi-factor authentication on all social media accounts, and conduct retrospective log analysis to identify prior interactions with this infrastructure. Security teams should treat any future resolution of this domain or IP as malicious until verified otherwise.