t-mobile[.]jirfn[.]icu

This domain, t-mobile.jirfn.icu, is identified as a brand impersonation threat specifically targeting X.com, a major social media platform. The site is designed to deceive users into believing they are interacting with official X.com services, potentially leading to unauthorized access to accounts, exposure of sensitive credentials, or installation of malicious software. The threat level is classified as elevated due to its targeted nature and potential impact on user security. Analysis indicates this domain was registered on December 8, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with suspicious domains. Infrastructure analysis reveals the site resolves to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335). At the time of detection, the domain was flagged by 16 out of 95 security vendors on VirusTotal, and it appeared on one security blocklist. The absence of an SSL certificate further undermines its legitimacy, as modern secure sites typically enforce encrypted connections. If you visited t-mobile.jirfn.icu or interacted with its content, immediate action is required. First, disconnect the device from the internet to prevent potential data exfiltration. Scan the device using updated security software to detect and remove any malicious payloads. Change passwords for X.com and any other accounts where the same credentials may have been reused, prioritizing accounts with sensitive or financial information. Monitor these accounts for unusual activity and enable multi-factor authentication where available. Report the incident to the targeted brand's security team to aid in broader mitigation efforts.