t-mobile[.]utafk[.]cc

Analysis of the domain t-mobile.utafk.cc indicates it was actively impersonating X.com (formerly Twitter) as part of a brand impersonation scheme. Registered on January 22, 2026, through Gname.com Pte. Ltd., the domain resolved to 188.114.96.3, a Cloudflare IP address (AS13335) geolocated in the US. Infrastructure review shows the domain used nameservers A.SHARE-DNS.COM and B.SHARE-DNS.NET, and no SSL certificate was present at the time of assessment. The page title 'Welcome to nginx!' suggests a default server configuration, which may indicate either an incomplete setup or an attempt to evade detection by presenting minimal content.

Security vendor scans on VirusTotal flagged the domain as malicious, with 14 of 93 engines detecting it. It also appears on one security blocklist, and Gridinsoft assigned a trust score of 0/100. The domain was taken offline following identification by PhishDestroy, though the exact timeline of its operational period remains unclear. While the page title and brand target suggest an X.com phishing attempt, the specific content and functionality of the site were not analysed, leaving the precise deception tactics unknown.

Defenders should treat this domain as confirmed malicious infrastructure. Blocking at the DNS and network level is recommended, along with monitoring for related domains using the same registrar, nameservers, or hosting IP. Given the use of Cloudflare, additional scrutiny of other domains resolving to the same IP range may uncover further impersonation attempts. No evidence links this domain to broader campaign infrastructure, but the registration date and hosting patterns align with common phishing operations targeting social media credentials.