t-mobile[.]tvkfo[.]cc

The domain t-mobile.tvkfo.cc was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolves to the Cloudflare address 104.21.10.166 (AS13335, United States). The site is hosted behind Cloudflare’s DNS, using the authoritative name servers jakub.ns.cloudflare.com and kinsley.ns.cloudflare.com. No TLS certificate is presented, and the HTTP response returns the default “Welcome to nginx!” page title, indicating that a generic web server is active rather than a branded landing page. Threat intelligence classifies the domain as a brand‑impersonation campaign targeting the brand x.com. The domain appears on a single security blocklist and is flagged by PhishDestroy.

VirusTotal analysis shows that 15 of 95 scanning engines flagged the domain, reflecting a moderate detection consensus. Gridinsoft assigns a trust score of 0 out of 100, which further underscores its malicious reputation. The current operational status is offline, suggesting that the phishing infrastructure has been taken down or is no longer serving content. What remains uncertain is the specific payload or credential‑harvesting mechanism that may have been delivered when the site was active, because the page content beyond the generic nginx title has not been captured.

No SSL certificate, custom page, or redirection details are available, limiting the ability to attribute the campaign to a particular phishing kit or to confirm the exact tactics employed. Defenders should continue to block t-mobile.tvkfo.cc at network perimeters and update any proxy or DNS filtering rules to include the domain and its associated IP address. Monitoring for re‑registration of the same second‑level domain or similar sub‑domains under the same registrar is advisable. Additionally, security teams should reference the VirusTotal detection count and the Gridinsoft trust score when prioritising remediation actions, and ensure that any endpoint alerts referencing x.com impersonation are correlated with this indicator.