t-mobile[.]zyoxl[.]cc

This domain, t-mobile.zyoxl.cc, poses a brand impersonation threat designed to deceive users into believing it is affiliated with X.com (formerly Twitter). The site mimics legitimate login portals, likely harvesting credentials or distributing malware under the guise of a trusted platform. The use of a subdomain structure (t-mobile.zyoxl.cc) suggests an attempt to exploit brand recognition, while the absence of SSL encryption increases the risk of data interception during transmission. Analysis indicates the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., an uncommon registrar for legitimate services. It resolves to IP address 104.21.65.238, hosted on Cloudflare’s infrastructure (AS13335), which is frequently abused for malicious campaigns due to its anonymity features. The domain appears on one security blocklist and is flagged by 16 out of 95 security vendors on VirusTotal, with a page title of 'Welcome to nginx!'—a default server banner that often indicates hastily deployed phishing infrastructure. The domain is currently offline, but its prior activity warrants caution. Users who visited t-mobile.zyoxl.cc should immediately revoke any credentials entered on the site, particularly X.com login details. Monitor accounts for unauthorized activity and enable multi-factor authentication where available. Network administrators should block the domain and its resolving IP (104.21.65.238) at the perimeter. If malware was downloaded, isolate the affected device and perform a full system scan using updated security tools. Report the domain to relevant threat intelligence platforms to aid in broader mitigation efforts.