t-mobile[.]qobkd[.]cc

The domain t-mobile.qobkd.cc was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolves to the Cloudflare address 172.67.193.25 (AS13335, United States). The site returns a default “Welcome to nginx!” page and does not present an SSL certificate, indicating that the infrastructure is a bare‑bones web server likely used only to host a malicious landing page. Threat intelligence classifies the site as a brand‑impersonation campaign targeting the x.com brand. The lack of a valid TLS certificate and the generic page title are consistent with a temporary hosting setup designed to evade content‑based detection. VirusTotal analysis shows that 11 of 93 scanners flagged the domain, providing independent confirmation of malicious intent. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service.

Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment that the domain is untrustworthy. No evidence of additional infrastructure such as C2 servers, credential‑stealing forms, or payload delivery was observed in the available data. Current status is offline, which may be a tactical takedown or a temporary suspension. Nevertheless, defenders should assume the domain remains part of an active impersonation infrastructure. Recommended mitigations include adding the domain to DNS‑based blocklists, enforcing HTTPS‑only policies to prevent accidental connections, and monitoring for re‑registration or resurrection of the same host‑name. Network sensors should flag any outbound traffic to 172.67.193.25 originating from internal users, and security teams should correlate logs with the known indicator set (domain, IP, nameservers bristol.ns.cloudflare.com and quentin.ns.cloudflare.com).

Because the site does not host a valid certificate, any attempt to establish a TLS connection will fail, providing an additional signal for detection.