t-mobile[.]qontr[.]cc

The domain t-mobile.qontr.cc has been identified as a brand-impersonation threat specifically targeting X.com (formerly Twitter) users. Analysis indicates this infrastructure was designed for credential harvesting or account takeover attempts, leveraging the T-Mobile branding to increase legitimacy. The domain is currently offline, though prior activity suggests it may have been operational during its brief existence. Infrastructure analysis reveals multiple high-confidence indicators of malicious intent. The domain was registered on February 21, 2026, through Dominet (HK) Limited, with resolution to IP address 47.90.164.222 hosted on Alibaba's US network (AS45102). Security vendors flagged this domain at an unusually high rate, with 18 of 95 VirusTotal engines detecting malicious activity. It appears on one security blocklist and was previously blocked by PhishDestroy. The server response included a default 'Welcome to nginx!' page title, suggesting either incomplete deployment or deliberate obfuscation of its true purpose. No SSL certificate was present, which is atypical for legitimate authentication portals. Current assessment places this domain in a high-risk category despite its offline status. The combination of brand impersonation, recent creation date, and lack of security controls creates significant potential for future malicious campaigns. Organizations and users are advised to implement DNS-level blocking for this domain and its associated IP address. Security teams should monitor for similar patterns involving mobile carrier branding in phishing infrastructure, particularly those targeting social media platforms. The domain's registration through a Hong Kong-based registrar and hosting on Alibaba's US infrastructure warrants additional scrutiny for related threat activity.