t-mobile[.]zlgdh[.]icu

This domain, t-mobile.zlgdh.icu, is flagged as an elevated-risk credential harvesting site targeting users of X.com. Analysis indicates the infrastructure was specifically engineered to impersonate the social media platform, likely to capture login credentials through deceptive landing pages. The threat type falls under brand impersonation with a focus on credential theft, a common tactic in large-scale phishing campaigns. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on December 7, 2025, and resolved to IP address 172.67.191.25, hosted on Cloudflare’s network (AS13335). The site lacked an SSL certificate, increasing the likelihood of interception during credential transmission. At the time of detection, the page displayed the default 'Welcome to nginx!' title, suggesting either incomplete deployment or an attempt to evade automated scanners. The domain appears on two security blocklists (PhishDestroy and PhishingDB) and is flagged by 17 out of 95 security vendors on VirusTotal, reinforcing its malicious classification. Mitigation steps for this threat type include immediate domain blacklisting at the network perimeter and endpoint levels. Organizations should deploy email and web filtering rules to block requests to t-mobile.zlgdh.icu and its associated IP address. Users who may have interacted with the domain should be instructed to reset their X.com credentials from a secure device and enable multi-factor authentication. Security teams are advised to monitor for signs of credential reuse across other platforms, as harvested data is frequently exploited in follow-on attacks. Given the domain’s current offline status, continuous monitoring for reactivation or migration to new infrastructure is recommended.