t-mobile[.]qkgmh[.]cc

This domain, t-mobile.qkgmh.cc, is flagged as a brand impersonation threat targeting users of X.com, a high-profile social media platform. Analysis indicates the domain was designed to mimic legitimate X.com login or verification pages, likely to harvest credentials, session tokens, or other sensitive user data. The presence of an nginx default page suggests the infrastructure was either hastily deployed or abandoned mid-operation, though this does not diminish the risk posed by the domain’s intent or prior activity.

Infrastructure analysis reveals the domain was registered on February 21, 2026, through Dominet (HK) Limited, a registrar frequently associated with malicious domains. It currently resolves to the IP address 47.253.81.117, hosted on Alibaba (US) Technology Co., Ltd. infrastructure (AS45102). The domain is detected by 18 out of 95 security vendors on VirusTotal and appears on at least one security blocklist. No SSL certificate was observed, further reducing the likelihood of secure communication and increasing the risk of interception or manipulation of transmitted data.

Users who visited t-mobile.qkgmh.cc should assume their credentials or session data may have been compromised. Immediate actions include revoking any active sessions on X.com, enabling multi-factor authentication if not already active, and monitoring accounts for unauthorized activity. System scans using updated security tools are recommended to detect potential malware or follow-on threats. If financial or personal data was entered, users should consider additional protective measures, such as credit monitoring or identity verification services.