t-mobile[.]bqidx[.]cc

t-mobile.bqidx.cc was registered on 21 February 2026 through Gname.com Pte. Ltd. The domain resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The authoritative name servers are marissa.ns.cloudflare.com and olof.ns.cloudflare.com, confirming Cloudflare DNS hosting. No TLS certificate is presented; HTTP requests return the default nginx page with the title “Welcome to nginx!”. The lack of HTTPS and the generic server banner suggest a low‑cost hosting setup often used for malicious landing pages. VirusTotal has recorded 13 positive detections out of 93 scanned vendors for this host, indicating that a minority of scanning engines have identified malicious activity linked to the domain.

The domain appears on a single external security blocklist, and the Gridinsoft trust score is 0 / 100, reinforcing the high probability of abuse. PhishDestroy has taken the domain offline and listed it as blocked. The only contextual indicator is the declared impersonation of the brand x.com, categorised as a brand‑impersonation campaign. No additional content analysis is available; the observed page title does not reference the target brand, and no SSL certificate or custom content has been observed.

Consequently, the precise phishing workflow (e.g., credential‑stealing form) cannot be confirmed at this time. Defenders should add 188.114.97.3 to network deny lists, enforce DNS blocks for t‑mobile.bqidx.cc, and monitor for newly created domains that share the bqidx.cc second‑level domain or use the same Cloudflare name servers. Endpoint security products that rely on VirusTotal or Gridinsoft scores will already flag this host, but manual rules based on the domain name and associated IP can reduce exposure. Continuous watch of the registrar Gname.com for future registrations of similar patterns is recommended, as well as periodic re‑scans to detect any changes in the host’s content or TLS deployment.