t-mobile[.]aorkd[.]cc

The domain t-mobile.aorkd.cc was registered on 2026-02-21 through Gname.com Pte. Ltd. and resolves to the IP address 188.114.96.3, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. DNS resolution uses Cloudflare nameservers ali.ns.cloudflare.com and rocco.ns.cloudflare.com. No TLS certificate is present, and HTTP requests return a 522 timeout, as reflected in the page title "aorkd.cc | 522: Connection timed out." The site has been taken offline, and its current status is listed as offline. Threat intelligence classifies the domain as a brand‑impersonation campaign targeting the T‑Mobile brand, employing the publicly known Airdrop Scam phishing kit.

Detection data shows that 15 of 93 security vendors on VirusTotal have flagged the domain as malicious, and the site is listed on one security blocklist. Gridinsoft assigns a trust score of 0 out of 100, indicating an extremely low reputation. The domain was blocked by the PhishDestroy filtering service.

Evidence confirms that the domain is actively used for brand impersonation, but the lack of a valid SSL certificate and the 522 timeout limit the ability to observe the exact malicious payload or page content. Defenders should add 188.114.96.3 to network blocklists, enforce DNS filtering of the domain, and monitor for similarly structured subdomains or new registrations using the same registrar and Cloudflare infrastructure. Continuous re‑evaluation is advised in case the domain is re‑hosted or the phishing kit is updated.