t-mobile[.]ftqrt[.]cc

This domain, t-mobile.ftqrt.cc, is identified as a brand impersonation threat specifically targeting users of X.com, a widely recognized social media platform. The site is designed to deceive visitors by presenting itself as an official or affiliated service, likely aiming to harvest login credentials, personal information, or facilitate unauthorized account access. Brand impersonation of this nature is particularly effective due to the trust users place in familiar platforms, increasing the likelihood of successful exploitation. The absence of an SSL certificate further compounds the risk, as it exposes any transmitted data to interception or manipulation during transit. Analysis of the domain reveals multiple technical indicators supporting its malicious classification. The domain was registered on February 21, 2026, through Dominet (HK) Limited, a registrar with a history of hosting suspicious infrastructure. It resolves to the IP address 47.90.164.225, located in the United States under AS45102, operated by Alibaba (US) Technology Co., Ltd. Detection metrics from VirusTotal indicate that 19 out of 95 security vendors have flagged the domain as malicious, while it also appears on one security blocklist. The page title, 'Welcome to nginx!', suggests the use of a default or misconfigured server, a common tactic in hastily deployed phishing campaigns to reduce overhead while maintaining functionality. Users who have visited t-mobile.ftqrt.cc are advised to take immediate remedial actions to mitigate potential risks. First, any credentials or sensitive information entered on the site should be considered compromised and changed immediately across all platforms where identical or similar credentials may have been reused. Affected accounts, particularly those associated with X.com, should be reviewed for unauthorized activity, including posts, messages, or linked applications. Enabling multi-factor authentication (MFA) is strongly recommended to add an additional layer of security. Additionally, users should monitor their devices for unusual behavior, such as unexpected network connections or unauthorized software installations, and consider running a full system scan using updated security tools. If financial or personally identifiable information was disclosed, users should also consider reporting the incident to relevant authorities and credit monitoring services to preempt potential identity theft or fraud.