t-mobile[.]tqsnc[.]icu

Analysis of the domain t-mobile.tqsnc.icu indicates it was a brand-impersonation phishing site targeting X.com (formerly Twitter). The domain was registered on December 13, 2025, through Gname.com Pte. Ltd. and hosted behind Cloudflare nameservers (aaden.ns.cloudflare.com and malavika.ns.cloudflare.com). It resolved to the IP address 172.67.166.69, associated with AS13335 (Cloudflare, Inc.) in the United States. No SSL certificate was detected, increasing the risk of unencrypted credential interception. The domain was flagged by 14 of 95 security vendors on VirusTotal, and it appeared on at least one blocklist (PhishDestroy).

The observed page title, 'Welcome to nginx!', suggests a default server configuration, which is atypical for legitimate brand-hosted pages but common in hastily deployed phishing infrastructure. Gridinsoft assigned a trust score of 0/100, reinforcing its high-risk classification. The domain was confirmed offline as of the report date (July 23, 2026), though defenders should monitor for re-emergence under similar naming patterns or infrastructure. Infrastructure analysis reveals the use of Cloudflare, a frequent choice for phishing operators due to its privacy protections and ease of setup.

The absence of SSL further aligns with low-effort phishing campaigns. While the exact content of the site remains unanalyzed, the combination of brand impersonation (X.com), low trust scores, and detection by multiple vendors confirms its malicious intent. Organizations should block the domain at the DNS level and investigate any prior connections from internal networks. No evidence links this domain to other known phishing kits or campaigns at this time.