t-mobile[.]qcxzj[.]cc

This domain, t-mobile.qcxzj.cc, operates as a credential-harvesting phishing site designed to impersonate X.com, the social media platform. The site presents a fraudulent login interface to trick users into submitting their account credentials, which are then captured by threat actors for unauthorized access or further malicious activities. The presence of a generic 'Welcome to nginx!' page suggests either an incomplete deployment or an attempt to mask the phishing infrastructure under a seemingly benign server banner. Analysis indicates the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.70.54, hosted on Cloudflare’s network (AS13335), a common tactic to obscure the true origin of malicious infrastructure. Detection metrics further confirm its malicious nature, with 18 out of 95 security vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued by Google Trust Services (WE1), does not mitigate its fraudulent intent. Users who visited t-mobile.qcxzj.cc should immediately take corrective actions to secure their accounts. First, change the password for any X.com account accessed through this domain, ensuring the new password is strong and unique. Enable multi-factor authentication (MFA) if not already active. Monitor the account for unauthorized activity, such as unfamiliar posts, messages, or linked applications. If financial or sensitive personal information was entered, consider placing a fraud alert with relevant institutions and reviewing credit reports for suspicious activity. Finally, report the domain to security teams or abuse contacts at the hosting provider (Cloudflare) and the registrar (Gname.com Pte. Ltd.) to aid in takedown efforts.