t-mobile[.]ebpxi[.]cc

The domain t-mobile.ebpxi.cc is identified as a brand impersonation threat specifically targeting X.com, a high-profile social media platform. Analysis confirms the domain was configured to mimic legitimate login portals, likely to harvest user credentials or distribute malicious payloads. As of the latest verification, the domain has been taken offline, though residual risk may persist due to cached DNS records or historical exposure. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk registrations. It resolved to the IP address 104.21.0.168, a shared hosting environment with a history of abuse. Security vendors flagged the domain in 18 of 95 VirusTotal scans, indicating moderate consensus on its malicious nature. The domain also appeared on one security blocklist, further corroborating its classification as a threat. Notably, the domain lacked an SSL certificate, and its default page displayed an "Welcome to nginx!" banner, a common artifact of misconfigured or hastily deployed phishing infrastructure. Current status indicates the domain is offline, reducing immediate exposure. However, organizations and individuals should remain vigilant. Network administrators are advised to block the domain and its resolving IP at the firewall or DNS level. End-users who may have interacted with the domain should rotate credentials for X.com and any other accounts where identical passwords were reused. Monitoring for unauthorized activity on linked accounts is strongly recommended. Security teams should treat this domain as part of a broader campaign and investigate for related indicators of compromise within their environments.