t-mobile[.]xqvwy[.]cc

This domain, t-mobile.xqvwy.cc, is flagged as a brand impersonation threat targeting x.com, a high-profile social media platform. The site is designed to deceive users into believing they are interacting with a legitimate x.com property, likely to harvest credentials, session tokens, or other sensitive authentication data. Brand impersonation of this nature is frequently used in credential theft campaigns, where attackers exploit trust in recognized brands to bypass user vigilance. The domain's infrastructure and content further suggest an intent to mimic official login portals or account verification pages, increasing the likelihood of successful compromise. Analysis indicates the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar often associated with malicious or high-risk registrations. It resolves to IP address 172.67.136.27, hosted on Cloudflare's network (AS13335), which is commonly used to obfuscate origin servers. The domain lacks an SSL certificate, a red flag for any site handling user data. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The page title, 'Welcome to nginx!', suggests a default server configuration, often indicative of hastily deployed or low-effort malicious infrastructure. Users who visited t-mobile.xqvwy.cc should assume potential exposure of credentials or session data. Immediate actions include resetting passwords for x.com and any other accounts where the same credentials may have been reused. Multi-factor authentication (MFA) should be enabled on all critical accounts to mitigate unauthorized access. If financial or personally identifiable information was entered, monitor accounts for unauthorized activity and consider reporting the incident to relevant fraud prevention authorities. Network-level blocking of the domain and its associated IP (172.67.136.27) is recommended for organizations to prevent further exposure.