t-mobile[.]xcsha[.]cc

The domain t-mobile.xcsha.cc has been identified as part of a brand impersonation campaign targeting x.com. Analysis indicates this domain is designed to deceive users into believing they are interacting with the legitimate x.com platform. As of the latest assessment, the domain has been taken offline, though prior activity suggests it was actively used for malicious purposes. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on February 21, 2026, and resolved to the IP address 104.21.17.149, hosted under AS13335 Cloudflare, Inc. in the United States. The domain appears on one security blocklist and is flagged by 14 of 95 security vendors on VirusTotal, indicating a moderate level of detection. Notably, the domain lacks an SSL certificate, and its page title, 'Welcome to nginx!', suggests the use of a default or misconfigured server setup, a common tactic in phishing infrastructure. Given the elevated risk level associated with this domain, organizations and users are advised to treat any prior interactions with t-mobile.xcsha.cc as compromised. Network administrators should block the domain and its associated IP address at the perimeter level. Users who may have engaged with the domain should reset credentials for x.com and any other accounts accessed during the suspected exposure window. Continuous monitoring for similar domains registered through the same registrar or resolving to the identified IP range is recommended to mitigate further risks.