t-mobile[.]quvgm[.]cc

This domain, t-mobile.quvgm.cc, is identified as a credential harvesting phishing site designed to mimic legitimate mobile carrier login portals. Analysis indicates the domain targets users by presenting fraudulent authentication pages, likely aiming to capture sensitive credentials such as usernames, passwords, and potentially multi-factor authentication codes. The infrastructure and naming convention suggest an intent to deceive users into believing they are interacting with a trusted service provider, increasing the likelihood of successful compromise. Technical evidence confirms the malicious nature of this domain. The domain was registered on January 13, 2026, through Dominet (HK) Limited, a registrar frequently associated with high-risk registrations. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious, indicating a consensus among detection engines. The domain resolves to the IP address 47.253.81.117, hosted on infrastructure belonging to Alibaba (US) Technology Co., Ltd. (AS45102), a provider commonly utilized for both legitimate and malicious operations. Additionally, the domain appears on one security blocklist, and no SSL certificate is present, further reducing its legitimacy. The page title, 'Welcome to nginx!', suggests a default or misconfigured server setup, often indicative of hastily deployed phishing infrastructure. Users who visited t-mobile.quvgm.cc or interacted with its content should take immediate remedial actions. If credentials were entered, reset passwords for the affected account and any other services where the same credentials may have been reused. Enable multi-factor authentication where available to add an additional layer of security. Monitor the account for unauthorized activity, such as unusual login attempts or transactions. Devices used to access the domain should be scanned for malware, as phishing sites may deploy malicious payloads or redirect to exploit kits. Network-level indicators, such as the IP address 47.253.81.117, should be blocked to prevent further exposure. Organizations are advised to update their security controls to include this domain and its associated indicators in their threat intelligence feeds for proactive detection and prevention.