t-mobile[.]miqr[.]cc

Analysis of the domain t-mobile.miqr.cc indicates it was actively involved in brand impersonation targeting X.com, as classified in threat intelligence records. The domain, registered on January 30, 2026, through Gname.com Pte. Ltd., resolved to the IP address 172.67.194.55, hosted on Cloudflare's infrastructure (AS13335) in the United States. No SSL certificate was detected, and the domain's HTTP response displayed the default 'Welcome to nginx!' page title, suggesting either an incomplete deployment or an attempt to evade immediate detection by presenting minimal content. The domain appears on one security blocklist and is flagged by 19 of 93 security vendors on VirusTotal, reinforcing its classification as malicious.

It was blocked by PhishDestroy and assigned a Gridinsoft trust score of 0/100, further confirming its high-risk status. Nameservers for the domain are configured as A.SHARE-DNS.COM and B.SHARE-DNS.NET, which are not inherently malicious but are frequently associated with low-reputation or disposable hosting setups. Infrastructure analysis reveals the domain was taken offline prior to July 23, 2026, though its prior activity and detection history remain relevant for retrospective threat hunting.

Defenders should treat this domain as confirmed malicious and prioritize blocking it at DNS, proxy, and endpoint layers. Historical logs should be reviewed for connections to 172.67.194.55 or interactions with the domain, particularly in contexts involving X.com or related authentication flows. No evidence of a phishing kit or specific payload is available, so further forensic analysis of archived content may be required to determine the exact attack vector.