t-mobile[.]vijdonh[.]cc

This domain, t-mobile.vijdonh.cc, poses as a legitimate X.com login portal but is designed to harvest user credentials through brand impersonation. Visitors may be tricked into entering sensitive account details, which attackers can exploit for unauthorized access, financial fraud, or further phishing campaigns. The site mimics the appearance of X.com, leveraging familiar branding elements to deceive users into believing it is an official or affiliated service.

Analysis indicates the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar often associated with high-risk domains. As of the latest scan, 18 out of 95 security vendors on VirusTotal flagged the domain as malicious. Infrastructure analysis reveals the domain resolves to the IP address 104.21.9.147, hosted on Cloudflare’s network (AS13335), and lacks an SSL certificate, further reducing its legitimacy. The page title, 'Welcome to nginx!', suggests a misconfigured or placeholder server, a common trait in hastily deployed phishing infrastructure.

If you visited t-mobile.vijdonh.cc or entered any credentials, take immediate action. Disconnect the device from the network to prevent potential data exfiltration. Change passwords for X.com and any other accounts where the same credentials were used, prioritizing accounts with financial or sensitive information. Enable multi-factor authentication (MFA) where available. Monitor accounts for unauthorized activity and report the incident to the targeted platform (X.com) for further investigation. Consider scanning the device for malware, as some phishing sites deploy additional payloads.