t-mobile[.]gqast[.]cc

This domain is flagged as an elevated-risk brand impersonation threat designed to harvest user credentials for X.com. Analysis indicates the infrastructure was configured to mimic legitimate login pages, likely through cloned HTML forms or redirected authentication prompts, with the intent of capturing usernames, passwords, and session tokens. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on February 21, 2026, and resolved to the IP address 172.67.175.74, hosted on Cloudflare’s network (AS13335). No SSL certificate was detected, increasing the likelihood of interception during transmission. The domain appears on one security blocklist and was flagged by 17 out of 95 security vendors on VirusTotal. The page title, 'Welcome to nginx!', suggests either a misconfigured server or an attempt to disguise the phishing page as a generic hosting error to evade detection. The domain is currently offline, but residual DNS records or cached pages may still pose a risk. Mitigation steps for this threat type include immediate blacklisting of the domain and IP across all network security controls, including firewalls, email gateways, and endpoint protection systems. Organizations should monitor for residual DNS queries or cached pages associated with t-mobile.gqast.cc and conduct a retrospective analysis of logs for any prior connections. Users who may have interacted with the domain should be instructed to reset their X.com credentials and enable multi-factor authentication. Security teams should also review registrar abuse contacts for similar domains under Gname.com Pte. Ltd. to identify potential patterns in brand-impersonation campaigns.