t-mobile[.]okmqc[.]cc

Analysis of t-mobile.okmqc.cc indicates that the domain was registered on February 21 2026 through Gname.com Pte. Ltd. and points to the Cloudflare address 172.67.136.177, which is announced by AS13335 (Cloudflare, Inc.) and geolocated to the United States. The authoritative name servers are ajay.ns.cloudflare.com and dolly.ns.cloudflare.com, confirming that the domain leverages Cloudflare’s DNS and edge services. No TLS certificate was observed for the host; HTTP requests return the generic “Welcome to nginx!” title, suggesting that the site served only a default web server page and did not host a custom landing page at the time of collection. The domain is classified as a brand‑impersonation campaign targeting the brand x.com. Detection engines on VirusTotal flagged the domain in 13 of 93 scanners, and the site appears on a single external blocklist.

PhishDestroy has already taken the domain offline, and the current status is reported as offline. Gridinsoft’s trust scoring system assigned a score of 0 / 100, reflecting a high confidence that the domain is malicious. The lack of an SSL certificate, combined with the generic server banner and the brand‑impersonation label, aligns with typical infrastructure used for short‑lived phishing or credential‑harvesting portals. Uncertainty remains regarding the exact payload or credential‑capture mechanism because the page content was not captured beyond the default nginx title. No additional intelligence such as malware hashes, phishing kit identifiers, or URL paths is available.

Consequently, defenders cannot assess whether the domain delivered further malicious redirects or data exfiltration. Given the observable indicators, security teams should add 172.67.136.177 to network‑level block lists, enforce DNS filtering for t-mobile.okmqc.cc, and update web‑gateway signatures to include the domain and its associated Cloudflare name‑servers.