t-mobile[.]muhry[.]cc

This domain is flagged for elevated-risk brand impersonation, specifically targeting X.com users through credential harvesting tactics. Analysis indicates the infrastructure was designed to mimic legitimate login portals, likely to capture authentication credentials or distribute malicious payloads under the guise of a trusted platform. The threat type aligns with known patterns of social engineering attacks exploiting brand recognition to deceive targets. Infrastructure analysis reveals the domain t-mobile.muhry.cc was registered through Gname.com Pte. Ltd. on February 21, 2026, and currently resolves to IP address 188.114.96.3, hosted on AS13335 Cloudflare, Inc. in the United States. The domain lacks an SSL certificate and displays a default "Welcome to nginx!" page title, suggesting either incomplete deployment or deliberate obfuscation. Security vendors flagged the domain in 17 out of 95 detection engines on VirusTotal, with one active security blocklist listing confirming its malicious classification. The creation date, combined with the absence of legitimate content, further supports the assessment of phishing infrastructure. Mitigation requires immediate action from network defenders and end users. Organizations should block the domain and its resolving IP (188.114.96.3) at the perimeter, while monitoring for internal connections to the infrastructure. Users should be alerted to verify domain authenticity before entering credentials, particularly for X.com-related services. Given the domain's current offline status, defenders should treat any future resolution attempts as high-risk events and investigate for potential compromise. Security teams are advised to review logs for prior connections to t-mobile.muhry.cc and correlate with authentication anomalies or unusual outbound traffic patterns.