t-mobile[.]nmvyi[.]cc

This domain, t-mobile.nmvyi.cc, operates as a credential harvesting phishing site targeting users of X.com (formerly Twitter). The infrastructure is designed to deceive visitors into submitting login credentials by mimicking the legitimate X.com interface, potentially enabling unauthorized account access and subsequent malicious activities such as data theft, spam propagation, or further social engineering attacks. The use of a subdomain incorporating "t-mobile" suggests an attempt to exploit trust in the telecommunications brand, increasing the likelihood of successful phishing attempts against mobile users or those expecting service-related communications. Analysis of the domain reveals multiple technical indicators of malicious intent. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., an uncommon registrar for legitimate services. It resolves to the IP address 104.21.69.207, hosted on Cloudflare’s network (AS13335), a common tactic to obscure the true origin of phishing infrastructure. Security vendors on VirusTotal flagged the domain as malicious, with 18 out of 95 engines detecting it. The domain appears on one security blocklist, and the page title "Welcome to nginx!" indicates a misconfigured or placeholder server, often seen in hastily deployed phishing campaigns. Notably, the domain lacks an SSL certificate, which is unusual for modern phishing sites but may reflect an incomplete setup or an attempt to evade detection by security tools that prioritize HTTPS-enabled domains. Users who visited t-mobile.nmvyi.cc should take immediate action to mitigate potential risks. If credentials were entered, reset passwords for X.com and any other accounts where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized posts, messages, or changes to account settings. Additionally, scan the device used to visit the domain for malware, as phishing sites may deploy malicious payloads or redirect to exploit kits. Report the incident to the legitimate service provider (X.com) and consider notifying local cybersecurity authorities or incident response teams for further guidance.