t-mobile[.]qwxoz[.]cc

The domain t-mobile.qwxoz.cc has been classified as an elevated risk due to its involvement in a brand impersonation phishing campaign targeting T-Mobile. This domain was designed to deceive users by imitating the T-Mobile brand, potentially to collect personal information or credentials. The risk level is deemed elevated due to the potential impact of such impersonation and the relatively high detection count.

The domain was registered through Gname.com Pte. Ltd. on February 21, 2026, and resolves to IP address 188.114.97.3, associated with AS13335, which belongs to a U.S.-based service provider known for offering various internet infrastructure services. At the time of investigation, 15 out of 95 security vendors on VirusTotal have flagged this domain as malicious, indicating a significant recognition within the cybersecurity community. Additionally, it appears on at least one security blocklist, further corroborating its malicious intent. There is no SSL certificate associated with this domain, which is a common characteristic of phishing sites, as it helps avoid raising suspicion while collecting sensitive data.

To mitigate the risks posed by this phishing attempt, individuals and organizations should be advised to exercise caution when encountering domains mimicking well-known brands such as T-Mobile. Users should be trained to verify URLs carefully and consult blocklists or security services if they encounter suspicious domains. Implementing comprehensive email and web filtering solutions can help prevent access to such threats. Furthermore, continuous monitoring and reporting of suspicious domains to appropriate authorities can aid in their swift shutdown, as observed with the current offline status of this domain.