t-mobile[.]miqa[.]cc

Infrastructure analysis of t-mobile.miqa.cc reveals a brand-impersonation scam targeting x.com, first observed on February 21, 2026. The domain is registered through Gname.com Pte. Ltd. and uses Cloudflare nameservers (gordon.ns.cloudflare.com, linda.ns.cloudflare.com), resolving to IP 172.67.215.25 within Cloudflare’s US network (AS13335). At the time of assessment, the domain presented an nginx default page with the title 'Welcome to nginx!', indicating either misconfiguration or an incomplete deployment of malicious infrastructure. No SSL certificate was detected, increasing the likelihood of interception or session hijacking if users were directed to this endpoint.

Detection data from July 23, 2026, shows 14 of 93 security vendors on VirusTotal flagging the domain, while PhishDestroy and at least one other blocklist have actively blocked it. Gridinsoft’s trust score of 0/100 further corroborates the elevated risk classification. The domain’s current offline status suggests takedown action, though historical DNS records and passive telemetry may still pose residual threats.

Defenders should monitor for related subdomains or newly registered lookalike domains under the same registrar or nameserver infrastructure. Given the absence of a valid SSL certificate and the use of Cloudflare’s proxy service, network-level detection rules should prioritize domains with similar hosting patterns, default page responses, and impersonation of high-profile social media platforms. No evidence of a phishing kit or specific payload was identified in the available data, leaving the exact attack vector uncertain.