t-mobile[.]qozac[.]cc

This domain, t-mobile.qozac.cc, is identified as a brand impersonation threat specifically targeting users of X.com (formerly Twitter). Analysis indicates the infrastructure was designed to deceive visitors into believing they are interacting with legitimate X.com services, likely through credential harvesting or account takeover attempts. The page title 'Welcome to nginx!' suggests the server was either misconfigured or intentionally left in a default state to avoid detection during early deployment phases. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to IP address 47.253.108.13, hosted on Alibaba (US) Technology Co., Ltd. infrastructure (AS45102). VirusTotal detection shows 21 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist, and no SSL certificate was observed, increasing the likelihood of interception or man-in-the-middle attacks. The absence of a valid certificate also suggests the operators prioritized rapid deployment over basic security measures. Users who visited t-mobile.qozac.cc should take immediate action to mitigate potential risks. Any credentials entered on this domain should be considered compromised and must be changed immediately on the legitimate X.com platform. Affected users should enable multi-factor authentication (MFA) on all accounts, particularly those linked to the same email or phone number used during the visit. Device scans for malware are recommended, as brand impersonation domains often deploy additional payloads. Network administrators should block the domain and its resolving IP (47.253.108.13) at the perimeter to prevent further exposure. Monitoring for unusual account activity or unauthorized access attempts is critical in the following 30 days.