t-mobile[.]mltjq[.]cc

t-mobile.mltjq.cc was flagged by the PhishDestroy feed as a brand‑impersonation site targeting the x.com brand. The domain was registered on 21 February 2026 and resolves to the Cloudflare address 104.21.8.21, which belongs to ASN 13335 in the United States. DNS resolution points to a generic nginx web server; the only visible page title is “Welcome to nginx!”, indicating that no customized landing page was captured before the site was taken offline. VirusTotal recorded 14 positive detections out of 95 scanning engines, and the domain appears on one external blocklist.

Independent reputation services assign a zero‑score trust rating (Scamadviser 0/100, Gridinsoft 0/100), reinforcing the malicious assessment. The SSL certificate is identified only as “WE1”, providing no additional validation of the operator’s identity. Because the site is currently offline, content‑level analysis (forms, URLs, credential‑stealing modules) cannot be confirmed, and the specific phishing kit remains unknown.

Defensive teams should immediately block the domain name and its resolving IP address at perimeter filters and DNS resolvers. Continuous monitoring of Cloudflare‑hosted infrastructure for newly‑registered domains with similar naming patterns is advised, as the attacker appears to rely on shared hosting services to evade attribution. Updating endpoint and web‑gateway threat‑intelligence with the observed detection counts and reputation scores will help reduce the risk of future impersonation attempts against x.com users.