t-mobile[.]qcxnw[.]cc

Analysis as of July 23 2026 indicates that the domain t-mobile.qcxnw.cc is currently offline. The domain was registered on February 21 2026 and resolves to the IP address 104.21.85.140, which is hosted by Cloudflare, Inc. (ASN 13335) in the United States. The SSL certificate presented for the host is identified as WE1, confirming that TLS is in place but offering no indication of legitimacy. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed.

VirusTotal scans show that 13 of 93 security vendors have flagged the domain as malicious, reinforcing the suspicion of phishing activity. No additional evidence such as Safe Browsing, Open Threat Exchange, registrar reputation, page title, or content analysis is available at this time. The limited detection surface suggests that the infrastructure is being leveraged for a generic phishing campaign, likely targeting users through credential‑stealing links. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑activation, and consider adding the IP address to network‑wide deny lists.

Because the site is hosted behind Cloudflare, any future hosting changes may obscure the true origin, so continuous monitoring of the domain’s DNS records and TLS fingerprint is recommended. Organizations that employ email filtering should ensure that URLs containing the t-mobile.qcxnw.cc suffix are treated as high‑risk. Incident response teams should also correlate any internal logs that reference the domain with the observed indicator set to determine exposure.