t-mobile[.]gtfic[.]cc

PhishDestroy identifies the domain t-mobile.gtfic.cc as an active brand impersonation threat specifically targeting x.com. This domain, which is currently offline, was created on February 21, 2026, and registered through Gname.com Pte. Ltd. It resolves to IP address 104.21.69.25 and lacks an SSL certificate, increasing the risk of data interception. The page title observed was "Welcome to nginx!" indicating a default server configuration often used in phishing setups.

According to intelligence data, t-mobile.gtfic.cc was flagged by 19 out of 95 VirusTotal security vendors, demonstrating widespread detection. It appears on one security blocklist and has no trust scores from reputable sources. The domain's registration through a lesser-known registrar and recent creation date are common indicators of malicious intent. The impersonation of x.com suggests the threat actor aims to steal login credentials or personal information from users expecting a legitimate x.com service.

Given that the domain is now offline, the immediate risk is mitigated, but users should remain vigilant. PhishDestroy recommends that anyone who may have interacted with this domain change their passwords immediately and enable two-factor authentication on their x.com accounts. Organizations should block this domain and its IP address in their security policies and educate users about verifying URLs before entering credentials. Continuous monitoring for similar domains is advised to prevent future attacks.