t-mobile[.]owgnp[.]icu

This domain, t-mobile.owgnp.icu, is identified as a brand-impersonation threat targeting X.com users. Analysis indicates the infrastructure was designed to deceive visitors into submitting login credentials through a fraudulent portal, likely leveraging social engineering tactics such as fake account verification prompts or urgent security alerts. The page title 'Welcome to nginx!' suggests a misconfigured or intentionally generic server response, a common obfuscation technique in phishing campaigns to avoid immediate detection by automated scanners. Infrastructure analysis reveals the domain was registered on December 13, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious registrations. It resolves to the IP address 172.67.142.173, hosted on Cloudflare’s network (AS13335), which may provide anonymity and resilience against takedowns. At the time of analysis, the domain was flagged by 15 out of 95 security vendors on VirusTotal, with no SSL certificate present, further reducing its legitimacy. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. As of the latest assessment, t-mobile.owgnp.icu has been taken offline, likely following abuse reports or registrar intervention. However, the elevated risk persists due to the domain’s recent creation and the potential for re-registration or migration to alternative infrastructure. Users who may have interacted with the domain are advised to reset credentials for X.com and any other services where identical passwords were reused. Organizations should monitor for residual threats, including follow-up phishing attempts or malware distribution via compromised accounts.