t-mobile[.]ckopt[.]cc

This domain, t-mobile.ckopt.cc, is identified as a brand impersonation threat specifically targeting X.com (formerly Twitter). Analysis confirms the domain is currently offline, though prior activity suggests it was designed to deceive users into believing they were interacting with legitimate X.com services. The threat type aligns with credential harvesting or fraudulent account access schemes, common in brand impersonation campaigns. Infrastructure analysis reveals the domain was flagged by 17 of 95 security vendors on VirusTotal, indicating moderate detection coverage. It was registered through Dominet (HK) Limited on January 23, 2026, and resolved to the IP address 47.252.25.174, hosted under AS45102 (Alibaba (US) Technology Co., Ltd.). The domain lacks an SSL certificate, a red flag for secure communication, and displays a default "Welcome to nginx!" page title, suggesting incomplete deployment or abandoned infrastructure. It appears on one security blocklist and was previously blocked by PhishDestroy. Current status confirms the domain is offline, though its registration remains active. Organizations should monitor for re-emergence or similar domains under the same registrar. Recommended actions include adding the domain to internal blocklists, alerting users to verify X.com URLs for legitimacy, and investigating the IP 47.252.25.174 for related malicious activity. Network defenders should also review logs for connections to this IP or domain to identify potential prior exposure.