t-mobile[.]qwjku[.]cc

Analysis of the domain t-mobile.qwjku.cc indicates it was actively involved in a tech support scam impersonating Apple, as documented in threat intelligence records. The domain, now offline, was registered on January 10, 2026, through Dominet (HK) Limited and resolved to IP address 47.253.81.117, hosted under AS45102 (Alibaba (US) Technology Co., Ltd.). Nameservers were configured as ns7.alidns.com and ns8.alidns.com, further linking the infrastructure to Alibaba’s DNS services.

The page title, 'T-Mobile Tuesdays - Get Free Stuff & Great Deals | T-Mobile,' suggests an attempt to mimic T-Mobile’s legitimate promotional platform, though the known scam type is explicitly classified as a tech support scam targeting Apple users. Detection data from July 24, 2026, shows the domain was flagged by 19 of 93 security vendors on VirusTotal and appeared on one security blocklist. The SSL certificate, identified as 'E8,' provides no additional trust indicators, and Gridinsoft assigned a trust score of 0/100.

While the domain is currently offline, its prior infrastructure and detection history confirm malicious intent. Defenders should treat any residual DNS or cached references to this domain as high-risk and prioritize blocking or monitoring related indicators, including the IP address and nameserver associations. No evidence of a phishing kit or additional page content is available for deeper classification, but the combination of brand impersonation, detection volume, and hosting patterns aligns with known tech support scam operations.