t-mobile[.]sctob[.]cc

This domain, t-mobile.sctob.cc, is identified as a brand impersonation threat targeting X.com users. The site is designed to mimic legitimate X.com login interfaces, tricking visitors into entering credentials or other sensitive information under false pretenses. Analysis indicates the domain is structured to exploit trust in the X.com brand, potentially leading to unauthorized account access or further social engineering attacks against victims. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., and currently resolves to the IP address 172.67.163.213, hosted on Cloudflare infrastructure in the United States. The domain appears on one security blocklist and is flagged by 20 out of 95 security vendors on VirusTotal. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as it is commonly used to lend a false sense of legitimacy to malicious sites. The page title, 'Welcome to nginx!', suggests a misconfigured or intentionally obfuscated server setup, a tactic often employed to evade detection. Users who visited t-mobile.sctob.cc should immediately assume their credentials or other sensitive data may have been compromised. Affected individuals should reset their X.com account passwords using a secure device and enable multi-factor authentication if not already active. Additionally, monitor the account for unauthorized activity, such as unusual posts, messages, or linked applications. If financial or personally identifiable information was entered, consider placing a fraud alert on credit files and reviewing recent transactions for signs of misuse. System scans for malware are recommended, as phishing sites may deploy additional payloads or redirect to exploit kits.