t-mobile[.]btlkx[.]cc

This domain, t-mobile.btlkx.cc, is identified as a brand impersonation threat specifically targeting users of X.com (formerly Twitter). The site presents a fraudulent login interface designed to harvest user credentials, including usernames, passwords, and potentially multifactor authentication codes. Analysis of the domain's infrastructure and behavior indicates it is part of a credential phishing campaign aimed at compromising social media accounts for further malicious activities, such as spreading disinformation, conducting financial fraud, or launching secondary phishing attacks against contacts. Evidence supporting this assessment includes multiple technical indicators. The domain was registered on January 22, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with suspicious domains. VirusTotal reports that 17 out of 95 security vendors have flagged t-mobile.btlkx.cc as malicious, with detections ranging from phishing to brand impersonation. The domain resolves to IP address 172.67.131.9, hosted on Cloudflare's network (AS13335), which is commonly used to obfuscate the true origin of malicious infrastructure. Additionally, the domain lacks an SSL certificate, increasing the risk of interception during credential transmission. It appears on one security blocklist, and the page title 'Welcome to nginx!' suggests a default server configuration, often indicative of hastily deployed phishing kits. Users who have visited t-mobile.btlkx.cc or entered credentials on this domain should take immediate action to mitigate potential compromise. First, change the password for the affected X.com account and any other platforms where the same credentials may have been reused. Enable multifactor authentication if not already active, using an authenticator app rather than SMS-based methods. Monitor the account for unauthorized activity, such as posts, messages, or connected applications that were not authorized. If financial or sensitive personal information was entered, consider placing a fraud alert on credit files and reviewing account statements for suspicious transactions. Organizations should update their email and web filtering rules to block this domain and its associated IP address, and security teams should investigate any internal systems that may have interacted with the domain for signs of compromise.