t-mobile[.]xwbqn[.]cc

The domain t-mobile.xwbqn.cc is flagged by 20 out of 93 VirusTotal vendors for malicious activity, indicating a significant threat level. This domain impersonates x.com, a tactic commonly used to deceive users into providing sensitive information. Despite its current offline status, it remains listed on one public blocklist, specifically PhishDestroy's.

Registered through Gname.com Pte. Ltd. and hosted on an IP managed by Cloudflare, Inc., this domain was created on February 21, 2026, yet was detected by PhishDestroy almost a month earlier, on January 25, 2026. The domain's page title, "Welcome to nginx!", suggests a default server page, possibly used to mask its true malicious intent or as a placeholder during setup.

The absence of an SSL certificate further indicates a lack of legitimate security measures, which is typical for fraudulent sites aiming to impersonate brands without investing in proper encryption. The platform risk score of 10/100 reflects the site's potential danger, despite its offline status. This case exemplifies how phishing domains exploit the gap between domain registration and detection by antivirus databases, allowing them to operate undetected for short periods.