t-mobile[.]bpfke[.]cc

Analysis of the domain t-mobile.bpfke.cc shows that it was registered on 21 February 2026 via Gname.com Pte. Ltd. and is hosted behind Cloudflare (AS13335, United States) using the IP address 172.67.222.90. The authoritative nameservers are ali.ns.cloudflare.com and rocco.ns.cloudflare.com, and the site served an SSL certificate issued by Google Trust Services under the WE1 identifier. HTTP traffic was observed using HTTP/3 and the only visible page title returned by the server was “bpfke.cc | 522: Connection timed out”, indicating that the origin server was unreachable at the time of the query.

The domain is attributed to a t-mobile brand impersonation campaign and is linked to an “Airdrop Scam” phishing kit. Security monitoring records show that the domain was blocked by PhishDestroy, appears on one external blocklist, and has been flagged by 14 of 95 antivirus and URL scanning engines on VirusTotal. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious classification.

The current status is offline, so the site is not actively serving content, but the underlying infrastructure—namely the Cloudflare‑protected IP and the associated SSL certificate—remains in place and could be re‑activated. Defenders should continue to block the domain and its resolved IP address in perimeter defenses, add the nameservers and SSL fingerprint to threat‑intel feeds, and monitor for any re‑registration or changes in host status. Since the exact landing page content has not been captured, further observation is advised to detect potential re‑use of the same infrastructure for future t-mobile impersonation attempts.