t-mobile[.]nocgk[.]cc

This domain, t-mobile.nocgk.cc, is flagged as a brand impersonation threat targeting X.com, a major social media platform. Analysis indicates the site was engineered to deceive users into submitting login credentials through a fabricated interface, likely leveraging social engineering tactics such as fake verification prompts or account suspension warnings. The page title, 'Welcome to nginx!', suggests the use of a misconfigured or intentionally obfuscated web server, a common tactic in phishing infrastructure to avoid immediate detection by automated scanners. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with malicious activity due to its lenient registration policies. It resolves to the IP address 104.21.7.17, which is part of AS13335 (Cloudflare, Inc.), a network often exploited for its content delivery and anonymization capabilities. The domain appears on one security blocklist and has been flagged by 20 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. The SSL certificate, issued by Google Trust Services (WE1), further complicates attribution by blending in with legitimate traffic. As of the latest assessment, t-mobile.nocgk.cc has been taken offline, likely due to enforcement actions by hosting providers or domain registrars. However, residual risk remains, as threat actors may re-deploy the same infrastructure under a new domain or IP address. Users who interacted with the site are advised to reset credentials for X.com and any other accounts where identical login details were reused. Organizations should monitor for similar domains registered through Gname.com Pte. Ltd. or resolving to Cloudflare IPs, as these indicators may signal ongoing or future phishing campaigns.