t-mobile[.]qlanx[.]cc

This domain was flagged as a brand‑impersonation site targeting the x.com brand. The domain t-mobile.qlanx.cc was registered on 21 February 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare’s network (AS13335) with the address 172.67.210.99, a location identified as the United States. The authoritative nameservers are lynn.ns.cloudflare.com and sasha.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. No TLS certificate is presented; HTTP requests return the default nginx welcome page titled “Welcome to nginx!”.

The site has been taken offline at the time of reporting, but historic activity placed it on at least one security blocklist and it is currently listed by PhishDestroy as a malicious entry. VirusTotal scans show that eight of ninety‑three antivirus or URL‑reputation engines flagged the domain, confirming that multiple independent products observed suspicious or malicious behavior. The Gridinsoft trust score of zero further reinforces the low credibility of the host. The observed indicators collectively point to a brand‑impersonation campaign that likely attempts to lure victims into interacting with a clone of x.com, although the exact payload or credential‑harvesting mechanism has not been disclosed.

Defenders should block DNS resolution for t-mobile.qlanx.cc, add the IP 172.67.210.99 to network‑level deny lists, and monitor for any outbound connections to that address. Email gateways should be updated to flag messages containing the domain or any URLs that resolve to the same IP. Continuous monitoring of Cloudflare‑hosted infrastructure for similar patterns is advised, as the attacker may deploy additional domains using the same nameserver pair. Threat intelligence feeds should be consulted for any emerging sightings of the domain or related aliases, and incident response teams should be prepared to investigate potential credential‑theft attempts that reference the x.com brand.