t-mobile[.]tlpsf[.]cc

The domain t-mobile.tlpsf.cc has been identified as a brand impersonation threat targeting X.com, a prominent social media platform. Analysis confirms the domain is currently offline, though prior activity suggests an intent to deceive users by mimicking legitimate X.com authentication or promotional pages. This infrastructure was likely designed to harvest credentials or distribute malicious content under the guise of the targeted brand. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on February 21, 2026, an unusual future date that may indicate an attempt to evade detection or exploit registrar policies. It resolves to the IP address 172.67.131.85, hosted on AS13335 (Cloudflare, Inc.), a network frequently leveraged to obscure malicious activity behind content delivery networks. The domain appears on one security blocklist and is flagged by 19 of 95 VirusTotal security vendors, indicating moderate but consistent detection. No SSL certificate was observed, further reducing the domain's legitimacy and increasing the likelihood of interception or manipulation of user data. The page title, 'Welcome to nginx!', suggests either misconfigured or placeholder content, a common trait in hastily deployed phishing infrastructure. Current status confirms the domain has been taken offline, though the underlying infrastructure may remain dormant or repurposed for future campaigns. Organizations and users are advised to block the domain and associated IP (172.67.131.85) at the network level to prevent potential re-emergence. Security teams should monitor for domains registered through the same registrar (Gname.com Pte. Ltd.) with similar naming patterns or future creation dates, as these may indicate related threat activity. Users who encountered this domain should reset credentials for X.com and any other accounts where identical login details were used, as credential harvesting was a likely objective. Proactive measures, such as deploying browser-based phishing protections and educating users on recognizing brand impersonation tactics, are recommended to mitigate similar threats.