t-mobile[.]qcyrj[.]cc

The domain t-mobile.qcyrj.cc was registered on February 21 2026 through Gname.com Pte. Ltd. The name incorporates the well‑known “t‑mobile” brand but the intelligence indicates the site is being used to impersonate x.com, as indicated by the declared brand target. The infrastructure is hosted behind Cloudflare, resolving to IP 104.21.80.93, which belongs to AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are shaz.ns.cloudflare.com and tadeo.ns.cloudflare.com, both Cloudflare‑operated. The site returned the generic HTTP response “Welcome to nginx!” and presented no TLS certificate, meaning traffic is unencrypted and the absence of HTTPS is typical for many low‑skill phishing deployments. Detection services have flagged the domain.

Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating. VirusTotal recorded 15 detections out of 93 submitted security vendors, confirming that multiple scanners consider the host malicious. The domain appears on at least one public blocklist and has been specifically blocked by the PhishDestroy feed, indicating that active defensive communities have already taken action. No Safe Browsing or OTX entries were supplied, and the current status is listed as offline, suggesting the site may have been taken down or is temporarily unavailable. Given the combination of a brand‑impersonation claim, a zero trust score, multiple vendor detections, and placement on blocklists, the domain should be treated as malicious.

Defenders are advised to add t-mobile.qcyrj.cc to outbound and inbound filtering rules, ensure that any internal DNS resolvers block resolution of the domain, and consider sinkholing the associated IP range if organizational policy permits. Continuous monitoring of the IP address 104.21.80.93 for resurgence of activity is recommended, as Cloudflare‑hosted infrastructure can be rapidly re‑used for new campaigns.