t-mobile[.]mwbel[.]cc

This domain, t-mobile.mwbel.cc, is identified as a brand impersonation threat targeting X.com, a high-profile social media platform. Analysis indicates the domain was engineered to deceive users into believing it is affiliated with the legitimate X.com brand, likely for credential theft or unauthorized account access. No crypto drainer kit signatures were detected in initial scans, but the domain exhibits characteristics consistent with credential harvesting infrastructure. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on February 21, 2026, an unusually future-dated creation that may indicate registry manipulation or error. It resolves to the IP address 172.67.130.182, hosted on Cloudflare’s network (AS13335) in the United States. Detection metrics show 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one additional security blocklist. The domain lacks an SSL certificate, and its page title, 'Welcome to nginx!', suggests a default server configuration, often associated with hastily deployed malicious infrastructure. As of the latest assessment, t-mobile.mwbel.cc has been taken offline, likely following reports to the registrar or hosting provider. Despite its inactive status, residual risk remains due to the domain’s prior association with brand impersonation and its potential for reactivation. Users who may have interacted with the domain are advised to monitor for unauthorized account activity, reset credentials, and verify the authenticity of any communications purporting to originate from X.com. Organizations should update blocklists to include this domain and its associated IP to mitigate future exposure.