t-mobile[.]thkei[.]cc

t-mobile.thkei.cc is a recently registered domain (created 21 Feb 2026) that has been classified as a brand‑impersonation site targeting x.com. The registration was performed through Gname.com Pte. Ltd., and the domain currently reports an offline status. Historical DNS data shows the zone using the Cloudflare authoritative nameservers liberty.ns.cloudflare.com and nitin.ns.cloudflare.com, and it resolves to the IP address 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. The web server responded with the default title “Welcome to nginx!”, indicating a generic Nginx instance without a custom SSL certificate; consequently the site was served over plain HTTP.

Reputation services have identified the domain as malicious: it appears on one public security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal analysis recorded 15 detections out of 93 scanners, reinforcing the malicious classification. Additional reputation scoring from Gridinsoft assigned a trust score of 0 / 100, the lowest possible rating. The evidence points to a deliberate attempt to misuse the brand name x.com, consistent with the “Brand Impersonation” scam type noted in the intelligence.

Because the domain is presently offline, active payload inspection is not possible, and the exact malicious content or credential‑harvesting mechanisms remain unknown. Defenders should proactively block the domain and its associated IP address at perimeter and DNS layers, add the domain to internal threat‑intel feeds, and monitor for any re‑registration or similar patterns using the same nameserver pair or Cloudflare edge IP range. Continuous re‑evaluation is advised should the domain become reachable again, at which point deeper content analysis would be required.