resumatiq[.]com

This domain, resumatiq.com, is identified as a brand impersonation threat specifically targeting users of x.com (formerly Twitter). The site presents itself as a legitimate login portal for x.com, potentially tricking users into entering credentials or other sensitive information. Such impersonation attacks are commonly used to harvest login details, which may later be exploited for unauthorized account access, financial fraud, or further phishing campaigns targeting the victim's contacts or associated services.

Analysis indicates the domain was registered on December 25, 2024, through REGRU-RU, a registrar frequently associated with malicious or high-risk domains. VirusTotal detection shows 3 out of 95 security vendors flagging the domain as malicious, while infrastructure analysis reveals it resolves to the IP address 31.31.207.36. The domain holds a Let's Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. It appears on one security blocklist and is currently offline, though this status may change. The default nginx welcome page suggests the site was either hastily deployed or abandoned after initial setup.

Users who visited resumatiq.com or entered credentials on the site should immediately change their x.com password and enable multi-factor authentication if not already active. Monitor the associated account for unauthorized activity, including posts, messages, or linked applications. Check connected email accounts or services for signs of compromise, as attackers may pivot to other platforms using the stolen credentials. If financial or payment details were entered, contact the relevant institution to flag potential fraud. Additionally, scan local devices for malware, as some phishing pages may deliver malicious payloads or browser-based exploits.