t-mobile[.]qozau[.]cc

This investigation documents the infrastructure and threat indicators associated with the domain t-mobile.qozau.cc, which is currently offline. The domain was registered on 28 January 2026 through Gname.com Pte. Ltd. and resolves to the Cloudflare‑owned address 172.67.195.206, located in the United States under ASN 13335. The authoritative nameservers are A.SHARE-DNS.COM and B.SHARE-DNS.NET. An SSL certificate identified as WE1 is present, and the HTTP response presents the generic page title “Welcome to nginx!” indicating a default web server configuration rather than a crafted login portal. VirusTotal records show that 15 of 93 security scanners flag this domain as malicious, reflecting a moderate consensus of compromise.

Gridinsoft assigns a trust score of zero out of one hundred, and the domain appears on a single external blocklist, which was subsequently enforced by the PhishDestroy blocking service. The listed scam type is “Brand Impersonation” targeting the brand x.com, confirming the intent to misuse the reputation of that service. While the available data confirms the domain’s association with phishing infrastructure, the specific payload, phishing kit, or exact credential‑harvesting pages have not been disclosed. Consequently, the precise tactics, techniques, and procedures (TTPs) remain unknown beyond the generic impersonation label.

Defenders should prioritize immediate containment by adding t-mobile.qozau.cc to URL filtering and DNS sink‑hole rules. Network sensors should be tuned to flag any outbound connections to the IP 172.67.195.206, especially over ports commonly used for web traffic. Continuous monitoring of the associated nameservers and the Gname.com registrar for future registrations may reveal related campaigns. Threat‑intel feeds should be updated to reflect the domain’s status and its affiliation with the x.com impersonation campaign.