t-mobile[.]tvkfw[.]cc

Analysis of t-mobile.tvkfw.cc indicates that the domain was registered on 21 February 2026 through Gname.com Pte. Ltd. The authoritative name servers are jakub.ns.cloudflare.com and kinsley.ns.cloudflare.com, pointing to Cloudflare’s network. DNS resolution returns the IPv4 address 172.67.201.64, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated to the United States. No TLS certificate is presented; HTTP requests return the default nginx landing page with the title "Welcome to nginx!". The lack of a brand‑specific page suggests the site was used only as a placeholder in the phishing infrastructure. VirusTotal records show that 15 of 93 scanned security vendors flagged the domain as malicious, and the domain appears on a single external blocklist.

PhishDestroy has also listed the domain as blocked. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. The listed scam type is "Brand Impersonation" with the targeted brand identified as x.com. Current status is offline, meaning the site is no longer reachable for active testing.

Nevertheless, the combination of recent registration, Cloudflare hosting, lack of SSL, and the presence on multiple detection platforms provides sufficient evidence to treat t-mobile.tvkfw.cc as a malicious infrastructure element. Defenders should add the domain and its resolving IP address to deny‑list rules, monitor for any future DNS changes, and consider broader Cloudflare‑hosted domains that exhibit similar naming patterns. Ongoing vigilance is advised because the attacker may migrate the payload to a new domain while retaining the same hosting provider. Because the site does not serve content beyond the default nginx page, there is no publicly visible phishing landing page to analyse, and the exact phishing kit remains unknown.