t-mobile[.]qozay[.]cc

This domain, t-mobile.qozay.cc, has been assessed as a high-risk threat, specifically a brand impersonation phishing site targeting T-Mobile customers. The site is currently offline, but while active, it was designed to deceive users into believing they were interacting with a legitimate T-Mobile portal, likely to harvest credentials or personal information.

Key indicators include a VirusTotal detection rate of 21 out of 95 security vendors, confirming malicious intent. The domain was registered through Gname.com Pte. Ltd. on February 21, 2026, and resolved to IP address 188.114.96.3. It appears on one security blocklist and is flagged by Google Safe Browsing as phishing. The SSL certificate was issued by Google Trust Services / WE1, which may have lent a false sense of legitimacy. The page title 'Welcome to nginx!' suggests a default server configuration, possibly indicating a quickly deployed phishing kit.

Users should avoid any interaction with this domain and ensure they do not reuse passwords associated with T-Mobile accounts. If credentials were entered, they should be changed immediately and multi-factor authentication enabled. Organizations should block the domain at the network level and educate users about verifying URLs before entering sensitive information. Monitoring for any related domains or follow-up attacks is also recommended.