t-mobile[.]qvgwr[.]cc

The domain t-mobile.qvgwr.cc has been identified as a threat due to brand impersonation, specifically targeting x.com. The site's page title, 'Welcome to nginx!', suggests it may have been set up as part of a phishing infrastructure attempting to mislead users by mimicking a legitimate brand. There is no evidence of a crypto drainer kit being employed on this domain.

Technical analysis reveals that 19 out of 95 security vendors on VirusTotal have flagged the domain as malicious. The domain was registered through Dominet (HK) Limited and resolves to the IP address 47.90.164.225, which is hosted in the United States under AS45102 Alibaba (US) Technology Co., Ltd. It was created on February 21, 2026, and appears on one security blocklist. The domain lacks an SSL certificate, which is a common indicator of illegitimate or hastily constructed phishing sites.

Currently, the domain is offline, mitigating its immediate threat. It has been blocked by at least one security service, PhishDestroy, which suggests that response actions have been taken to neutralize the threat. While the domain is inactive, it is crucial for users and organizations to remain vigilant against similar threats that may appear, and to ensure that security measures are in place to detect and block such phishing attempts in the future. Regular updates to blocklists and monitoring of new domain registrations are recommended to preemptively counteract brand impersonation threats.