t-mobile[.]qarhj[.]cc

This domain, t-mobile.qarhj.cc, is flagged for brand impersonation, specifically targeting x.com. Analysis indicates no direct evidence of a crypto drainer or credential theft kit, but the infrastructure aligns with known patterns of brand misuse. The page title, 'Welcome to nginx!', suggests a default server configuration, often indicative of hastily deployed malicious infrastructure or misconfigured phishing pages. No SSL certificate is present, increasing the likelihood of interception or tampering during data transmission. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 8.219.239.111, hosted on Alibaba (US) Technology Co., Ltd. infrastructure (AS45102) in Singapore. It was registered on January 14, 2026, through Dominet (HK) Limited, a registrar frequently associated with high-risk domains. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious, and it appears on one security blocklist. No Google Safe Browsing (GSB) detection is noted at this time, though this may reflect a lag in reporting rather than a clean status. The domain is currently offline, likely taken down due to detection or enforcement actions. However, the elevated risk persists due to the domain's recent creation date and association with a known brand impersonation campaign. Organizations should monitor for re-registration or similar domains under the same registrar or IP range. Network defenders are advised to block the resolved IP and domain at the perimeter, while end users should verify the legitimacy of any communication purporting to originate from x.com. The absence of SSL and the use of a default nginx page further underscore the need for heightened scrutiny of this infrastructure.