t-mobile[.]thkeo[.]cc

Analysis of the domain t-mobile.thkeo.cc confirms it as a brand impersonation phishing site targeting X.com, with elevated risk indicators as of July 23, 2026. The domain, now offline, was registered on February 21, 2026, through Gname.com Pte. Ltd. and resolved to IP 188.114.97.3, hosted on Cloudflare's network (AS13335). Infrastructure analysis reveals Cloudflare nameservers (liberty.ns.cloudflare.com, nitin.ns.cloudflare.com) and the absence of an SSL certificate, a common red flag for fraudulent sites. The HTTP response returned a default 'Welcome to nginx!' page title, indicating either misconfiguration or an attempt to conceal malicious content behind a generic server banner.

VirusTotal detections from 15 of 95 security vendors further corroborate its malicious classification, though the specific payload or phishing kit remains unconfirmed. The domain appears on at least one security blocklist (PhishDestroy) and has a Gridinsoft trust score of 0/100, reinforcing its fraudulent nature. While the exact scam mechanics are not fully documented, the combination of brand impersonation targeting X.com, low-reputation registrar, and Cloudflare-hosted infrastructure aligns with known phishing tactics. Defenders should treat this domain as confirmed malicious, particularly in environments where X.com is a protected brand.

Blocklist the domain and IP 188.114.97.3 at perimeter security controls, and monitor for related subdomains or newly registered lookalike domains under the same registrar. Given the domain's current offline status, further forensic analysis may be limited, but historical DNS and WHOIS records should be preserved for potential incident response. No evidence suggests persistence beyond the reported takedown, but vigilance is advised for similar infrastructure reuse.