t-mobile[.]hsxtb[.]cc
“Welcome to nginx!”
t-mobile.hsxtb.cc — Conteúdo indisponível (HTTP 502). Resumo das evidências: VirusTotal 17/93 (ADMINUSLabs, Criminal IP, BitDefender, Cluster25, CRDF); URLQuery 4 alerts; PhishDestroy score 95/100. Registrador: Gname.
A análise detalhada do PhishDestroy AI permanece em inglês para preservar o registro forense original.
This domain is flagged for elevated-risk brand impersonation, specifically targeting users of the social media platform X.com. Analysis indicates the domain t-mobile.hsxtb.cc was designed to mimic legitimate login portals, likely to harvest user credentials through deceptive input forms. The threat type—brand impersonation—is confirmed by the domain's structural resemblance to official branding and its association with known phishing tactics targeting high-profile platforms. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on February 21, 2026, an unusually future-dated creation that may indicate an attempt to evade detection or exploit registration loopholes. It resolves to the IP address 172.67.209.91, hosted on AS13335 (Cloudflare, Inc.) in the United States, a common proxy service used to obscure malicious origins. The domain lacks an SSL certificate, a red flag for secure communications, and displays a default "Welcome to nginx!" page, suggesting incomplete deployment or rapid takedown. Detection metrics show 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist, specifically PhishDestroy. No additional trust scores or historical reputation data are available, further limiting its legitimacy. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP (172.67.209.91) at the network perimeter. Organizations should deploy email and web filtering rules to prevent users from accessing t-mobile.hsxtb.cc or any subdomains. End-users should be educated on recognizing brand impersonation tactics, particularly the absence of SSL indicators (e.g., "https://") and mismatched domain names. Incident response teams should monitor for credential reuse attempts, as harvested data may be leveraged in follow-up attacks. Given the domain's current offline status, continuous monitoring for re-emergence or similar infrastructure (e.g., same registrar or IP range) is recommended.
Inteligência de segurança de rede
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| Quad9 DNS | t-mobile.hsxtb.cc |
malicious | Sinkholed |
| OpenDNS | t-mobile.hsxtb.cc |
phishing | Phishing Block |
| Hagezi Threat Feed | t-mobile.hsxtb.cc |
malicious | Sinkholed |
| DNS4EU | t-mobile.hsxtb.cc |
malicious | Sinkholed |
Pipeline de resposta a ameaças
Status da lista de bloqueios pública
Análise do VirusTotal
Evidências e relatórios externos
PD-20260125-1EF4AF Recipient: complaint@gname.com Você foi afetado por este site?
Se você inseriu credenciais de conta, informações pessoais ou de pagamento, ou baixou um arquivo deste domínio, tome medidas imediatas. Abaixo estão os recursos para ajudá-lo a relatar o incidente e se proteger.
Notifique as autoridades locais
Selecione seu país para obter contactos oficiais do cibercrime ou crie um rascunho de reclamação →.
Verificar qualquer domínio
Análise de ameaças usando lista de bloqueio armazenada, WHOIS, DNS e evidências de verificação pública
Digitalize agoraDenunciar phishing
Envie domínios suspeitos para nosso banco de dados de ameaças — proteja a comunidade
DenunciarFeed de ameaças em tempo real
Relatórios recentes de phishing e alterações de disponibilidade observadas
MonitorarMantenha-se informado, mantenha-se seguro
Monitore ameaças em tempo real ou conteste esta listagem caso acredite que se trate de um falso positivo