t-mobile[.]govk[.]cc

This domain is flagged as an elevated-risk brand impersonation threat designed to deceive users of x.com. Analysis indicates the infrastructure was specifically engineered to mimic legitimate services while facilitating unauthorized access or data collection, a common tactic in credential harvesting campaigns. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain t-mobile.govk.cc, registered through Gname.com Pte. Ltd. on February 21, 2026, currently resolves to IP 47.86.49.23 (AS45102, Alibaba (US) Technology Co., Ltd., Hong Kong). It lacks SSL certification and displays the default nginx welcome page, suggesting either incomplete deployment or deliberate obfuscation. Security vendors flagged the domain in 18 of 95 VirusTotal scans, while PhishDestroy and one additional blocklist have implemented active protections. The creation date discrepancy (2026) further indicates suspicious registration practices, likely an attempt to bypass temporal-based detection systems. Mitigation requires immediate action from both organizational and individual stakeholders. Network administrators should implement DNS-level blocking for t-mobile.govk.cc and its resolving IP 47.86.49.23, while monitoring for related subdomains or IP adjacencies within the same ASN. Security teams should prioritize user education on brand impersonation tactics, particularly domains combining mobile service terminology with unrelated TLDs. End users should verify domain authenticity through official channels before interaction, especially when encountering unexpected login prompts or account verification requests. Continuous monitoring of certificate transparency logs and passive DNS records is recommended to detect potential re-emergence of this threat infrastructure.