t-mobile[.]qwxdr[.]cc

The domain t-mobile.qwxdr.cc was registered on 21 February 2026 through Dominet (HK) Limited and resolves to the IPv4 address 47.253.81.117, which is assigned to Alibaba (US) Technology Co., Ltd. (AS45102) located in the United States. The authoritative name servers are ns7.alidns.com and ns8.alidns.com, both operated by Alibaba Cloud DNS. No TLS certificate is presented; HTTP requests receive the default nginx welcome page titled “Welcome to nginx!”, indicating that the web server is likely a misconfigured or placeholder instance rather than a crafted phishing landing page. The domain is currently taken offline but remains listed on the PhishDestroy blocklist, and it appears on a single security blocklist overall.

VirusTotal analysis shows that 18 of 95 scanned scanners flagged the domain, providing independent confirmation of malicious intent. The combination of recent registration, use of a reputable cloud provider’s DNS, absence of HTTPS, and the presence on a phishing‑focused blocklist suggests that the domain was intended for a credential‑harvesting campaign targeting users who might associate the sub‑domain “t‑mobile” with the legitimate mobile carrier. However, without a captured payload or observed phishing page content, the exact luring technique and target audience remain uncertain.

Defenders should block the domain at perimeter firewalls, update URL filtering policies to include the full hostname, and monitor DNS queries for the associated IP and name servers. Incident responders should also query recent logs for any authentication attempts to T‑Mobile services that originated from this host, and consider reporting the indicator to additional threat‑sharing platforms to increase visibility. Continuous revalidation is advised, as the domain could be re‑activated or used in future campaigns.