t-mobile[.]tvkft[.]cc

On 23 July 2026 analysts examined the domain t-mobile.tvkft.cc, which is classified as a brand‑impersonation campaign targeting the x.com brand. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolves to the Cloudflare address 104.21.2.250 located in the United States under ASN 13335. The authoritative nameservers are jakub.ns.cloudflare.com and kinsley.ns.cloudflare.com, indicating that the infrastructure is fully hosted on Cloudflare’s network. No TLS certificate was observed; the HTTP response returns the default “Welcome to nginx!” page title, suggesting the site is either a placeholder or has been taken offline.

The Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy filtering service. VirusTotal reports that 12 of 95 scanning engines flagged the domain, confirming that multiple vendors have identified malicious characteristics. The current operational status is listed as offline, and the site is not serving any content that can be further analysed.

Evidence gaps remain: the exact phishing landing page, credential‑harvesting mechanisms, and any secondary infrastructure have not been captured, as the site no longer returns active content. Consequently, attribution of payloads or phishing kits cannot be confirmed. Defenders should continue to monitor DNS resolutions for the domain and its associated IP address, enforce blocklisting of 104.21.2.250 and the domain itself in perimeter security appliances, and propagate the indicator to threat‑intelligence sharing platforms. Given the low trust score, blocklist presence, and multi‑vendor detections, the domain should be treated as malicious and excluded from all user‑facing services.