t-mobile[.]tiakcnb[.]cc

This domain presents an elevated risk due to its brand impersonation of X.com, specifically designed to trick users into believing they are accessing a legitimate login portal. The threat is a classic credential harvesting scheme, where unsuspecting visitors may unknowingly submit their sensitive login information to malicious actors. PhishDestroy has classified this as a brand impersonation attack, and the domain is now offline, but similar variants may still be active.

Technical analysis reveals concerning indicators. VirusTotal flagged this domain with 16 out of 95 security vendors marking it as malicious, a significant detection rate. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., and it resolves to IP address 188.114.96.3. No SSL certificate was present, which is unusual for a legitimate site and further indicates phishing intent. The page title displayed only "Welcome to nginx!" suggesting a default or minimal setup. The domain appeared on one security blocklist, and PhishDestroy's own trust scoring system rated it as high risk. The unique seed for this analysis is 5523f8.

To protect against this specific threat, users should always verify the URL before entering credentials on any site claiming to be X.com. Bookmark the official website or use a trusted search engine to navigate there. If you have already visited this domain and entered any information, change your X.com password immediately and enable two-factor authentication. Report any suspicious domains to PhishDestroy for further investigation and blocking. Never click on links in unsolicited messages claiming to be from X.com, and always check for HTTPS and proper SSL certificates before logging in.