t-mobile[.]fwdwdy[.]bond

This domain, t-mobile.fwdwdy.bond, is identified as an active credential phishing infrastructure targeting users of X.com, a prominent social media platform. Analysis indicates the domain employs brand impersonation techniques, presenting a deceptive interface likely designed to harvest login credentials or session tokens. The page title, 'Welcome to nginx!', suggests the use of a misconfigured or intentionally minimal server response, potentially masking a more sophisticated phishing kit deployed behind Cloudflare's reverse proxy. Infrastructure analysis reveals the domain was registered on December 8, 2025, through Gname.com Pte. Ltd., and resolves to the IP address 172.67.202.209, hosted under AS13335 (Cloudflare, Inc.). The domain is flagged by 17 out of 95 security vendors on VirusTotal, and appears on two independent security blocklists: PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend legitimacy to malicious domains. No Google Safe Browsing (GSB) detection was explicitly noted in the available data. As of the latest assessment, t-mobile.fwdwdy.bond remains active and poses an elevated risk to users. The domain's use of Cloudflare infrastructure complicates takedown efforts by obfuscating the origin server. Organizations are advised to block the domain and its resolving IP at the network level, while end-users should be alerted to avoid interaction. Continuous monitoring is recommended, as the operators may rapidly redeploy the phishing kit to new domains or subdomains using similar naming conventions.