t-mobile[.]wjuxo[.]cc

This domain, t-mobile.wjuxo.cc, is flagged for brand impersonation targeting X.com, a high-profile social media platform. The infrastructure is designed to deceive users into submitting login credentials or personal information by mimicking legitimate X.com authentication portals. Analysis indicates the domain was specifically engineered for credential harvesting, leveraging visual and functional similarities to the genuine platform to exploit user trust. The threat is classified as elevated due to the targeted nature of the impersonation and the potential for significant account compromise. Infrastructure analysis reveals the domain was registered on January 22, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with malicious activity. The domain resolves to IP address 172.67.184.19, hosted on AS13335 (Cloudflare, Inc.), a network commonly used to obfuscate malicious infrastructure. At the time of assessment, the domain lacked an SSL certificate, increasing the risk of interception or manipulation of user data. Security vendors flagged the domain in 15 out of 95 scans on VirusTotal, and it appears on one security blocklist, further corroborating its malicious intent. The page title, 'Welcome to nginx!', suggests the use of a misconfigured or default server setup, often indicative of hastily deployed phishing infrastructure. Users who visited t-mobile.wjuxo.cc should assume their credentials or personal information may have been compromised. Immediate action is required: reset passwords for X.com and any accounts sharing the same credentials. Enable multi-factor authentication (MFA) on all critical accounts to mitigate unauthorized access. Monitor financial and communication platforms for signs of fraudulent activity, such as unauthorized logins or transactions. If sensitive data was entered, consider reporting the incident to relevant authorities or identity protection services. Organizations should update internal blocklists to include this domain and its associated IP address (172.67.184.19) to prevent further exposure.