t-mobile[.]qkqrt[.]cc

PhishDestroy has identified t-mobile.qkqrt.cc as a confirmed brand impersonation domain, specifically targeting x.com. This malicious domain is now offline, but its recent activity posed a significant risk to users who may have encountered it while expecting legitimate x.com services. The domain was created on January 15, 2026, and registered through Dominet (HK) Limited, a registrar often associated with suspicious domains.

Technical analysis reveals that t-mobile.qkqrt.cc resolved to IP address 47.253.81.117 and lacked an SSL certificate, a clear red flag for any site handling sensitive information. The page title displayed "Welcome to nginx!" which is a default landing page, suggesting the site was either under construction or quickly set up for malicious purposes. VirusTotal data shows that 17 out of 95 security vendors flagged this domain as malicious, and it appears on one security blocklist. These indicators collectively confirm the domain's malicious intent and its association with phishing or credential theft campaigns.

Currently, t-mobile.qkqrt.cc has been taken offline, neutralizing the immediate threat. However, users who may have visited this domain or provided any credentials should change their passwords immediately and monitor their accounts for suspicious activity. PhishDestroy recommends blocking this domain at the network level and adding it to threat intelligence feeds to prevent future access. Always verify URLs before entering sensitive information, especially when dealing with brand impersonation attempts targeting well-known services like x.com.