t-mobile[.]ozxaq[.]icu

This domain is flagged for elevated-risk brand impersonation, specifically targeting x.com users. Analysis indicates the infrastructure was designed to mimic legitimate branding, likely to deceive victims into disclosing credentials or interacting with malicious content. The threat type aligns with phishing campaigns that exploit recognizable corporate identities to bypass user skepticism and facilitate unauthorized access or data exfiltration. Infrastructure analysis reveals the domain t-mobile.ozxaq.icu was registered on December 08, 2025, through Gname.com Pte. Ltd. It resolves to the IP address 172.67.218.122, hosted on AS13335 Cloudflare, Inc. infrastructure located in the US. The domain lacks an SSL certificate, a common red flag for fraudulent sites. Security vendors on VirusTotal flagged the domain at a rate of 18/95, indicating moderate consensus on its malicious nature. It appears on two security blocklists, PhishDestroy and PhishingDB, and the page title "Welcome to nginx!" suggests a default server configuration, often associated with hastily deployed phishing infrastructure. The domain is currently offline, but its creation date and technical indicators suggest it was active during a recent campaign. Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its resolving IP (172.67.218.122) at the network perimeter. Organizations should monitor for internal traffic to this domain or similar impersonation attempts, particularly those targeting x.com or related brands. Security teams are advised to review logs for connections to the registrar (Gname.com Pte. Ltd.) or Cloudflare-hosted IPs during the domain's active period. User awareness training should emphasize verifying domain authenticity before entering credentials, especially for high-profile brands. Additionally, implementing DMARC, DKIM, and SPF policies can reduce the risk of similar impersonation attacks via email. If credentials were entered on this domain, immediate password resets and multi-factor authentication enforcement are recommended for affected accounts.