t-mobile[.]qocbn[.]cc

The domain t-mobile.qocbn.cc was registered on February 21, 2026 through Dominet (HK) Limited and is currently offline. Infrastructure analysis shows it resolves to the IPv4 address 47.90.164.222, which is announced by AS45102, an Alibaba (US) Technology Co., Ltd. hosting network located in the United States. No TLS certificate is presented; the HTTP response returns the default nginx page title "Welcome to nginx!" indicating a bare web server without application‑level content. The domain is associated with a brand‑impersonation campaign targeting x.com, as indicated by the provided scam type and brand target fields.

Reputation checks reveal a Gridinsoft trust score of 0 out of 100, suggesting an extremely low trust rating. VirusTotal data shows that 16 of 93 scanned security vendors flagged the domain, reinforcing the malicious assessment. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service. Nameserver records point to ns7.alidns.com and ns8.alidns.com, both typical of Alibaba Cloud DNS services.

While the page content has not been examined beyond the generic nginx title, the combination of brand impersonation intent, low trust score, multi‑vendor detections, and hosting on a known cloud provider used for malicious campaigns provides sufficient evidence for defensive teams to treat the domain as hostile. Defenders should ensure that any traffic to t-mobile.qocbn.cc is denied at perimeter controls, update URL filtering and threat intelligence feeds with the domain and its IP address, and monitor for any resurgence of the domain or related subdomains. Continued observation of the hosting ASN and associated DNS infrastructure is advised, as threat actors may re‑register similar names or shift to new IPs within the same cloud provider.