t-mobile[.]eqpao[.]icu

This domain, t-mobile.eqpao.icu, is flagged as a brand impersonation threat specifically targeting X.com (formerly Twitter) users. Analysis indicates the infrastructure was designed to mimic legitimate login portals, likely to harvest credentials or distribute malware. No drainer kit signatures were observed in available telemetry, but the nginx default page suggests recent deployment or incomplete setup at the time of detection.

Infrastructure analysis reveals the domain was registered on December 14, 2025, through Gname.com Pte. Ltd. It resolves to the IP address 104.21.36.236 and currently lacks an SSL certificate. VirusTotal shows 16 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. Google Safe Browsing (GSB) status is not explicitly listed, but the detection ratio and blocklist presence confirm active malicious classification.

The domain has since been taken offline, likely due to abuse reports or registrar enforcement. However, residual risk remains as the infrastructure (IP, registrar account) may be reused for future campaigns. Users who interacted with the domain should assume credential exposure and enable multi-factor authentication on X.com immediately. Network defenders are advised to block the IP 104.21.36.236 and monitor for related domains registered through Gname.com Pte. Ltd. with similar naming patterns.