t-mobile[.]ghiqs[.]cc

This domain is flagged for elevated-risk brand impersonation targeting X.com users. Analysis indicates the site was designed to deceive visitors into believing they were interacting with the legitimate X.com platform, potentially harvesting credentials or sensitive information under false pretenses. Infrastructure analysis reveals the domain t-mobile.ghiqs.cc was registered on February 21, 2026, through Gname.com Pte. Ltd. It resolves to the IP address 104.21.74.207, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain lacks an SSL certificate and displays a default nginx welcome page, suggesting either an incomplete setup or an attempt to evade detection. Security vendors on VirusTotal flagged the domain at a rate of 18/95, and it appears on at least one blocklist. The page title, 'Welcome to nginx!', further indicates misconfigured or obfuscated malicious infrastructure. Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its associated IP (104.21.74.207) at the network perimeter. Organizations should monitor for credential reuse attempts, particularly from users who may have interacted with the site before it was taken offline. Security teams are advised to review logs for connections to the domain or IP and assess potential exposure. User awareness training should emphasize verifying domain authenticity, especially for platforms like X.com, where impersonation risks are prevalent. Additionally, reporting the domain to relevant security communities can aid in broader threat intelligence sharing.