t-mobile[.]qwopt[.]cc

This domain, t-mobile.qwopt.cc, is flagged as a brand impersonation phishing site targeting X.com users. Analysis indicates the infrastructure was configured to harvest login credentials, likely through a spoofed authentication portal. The page title 'Welcome to nginx!' suggests a default server configuration, possibly indicative of hastily deployed or repurposed phishing infrastructure. No drainer kit signatures were identified in the available telemetry, though the lack of SSL encryption and default server banner increase the likelihood of credential interception. Technical indicators confirm elevated risk: the domain was registered on February 21, 2026, through Dominet (HK) Limited, and resolves to IP 47.253.81.117, hosted on Alibaba (US) Technology Co., Ltd. infrastructure (AS45102). VirusTotal detection stands at 20/95 security vendors, while the domain appears on one security blocklist. No Google Safe Browsing (GSB) entries were recorded prior to takedown. The absence of an SSL certificate further undermines secure communication, aligning with common phishing tactics to avoid encryption-related warnings. The domain is currently offline, having been taken down following detection. Response actions included blocking by security providers and removal from DNS resolution. Despite its inactive status, residual risk persists due to potential reuse of the IP or registration of similar domains under the same registrar. Users who may have interacted with the site are advised to rotate credentials immediately and monitor for unauthorized account activity. Organizations should review logs for connections to 47.253.81.117 and assess exposure to brand impersonation campaigns targeting social media platforms.