t-mobile[.]tvkfi[.]cc

Analysis of t-mobile.tvkfi.cc indicates a brand‑impersonation campaign targeting the x.com brand. The domain was registered on February 21, 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare infrastructure (AS13335) with the IP address 172.67.192.146 located in the United States. DNS resolution points to the Cloudflare nameservers jakub.ns.cloudflare.com and kinsley.ns.cloudflare.com, confirming the use of a reputable CDN provider for anonymity and traffic shielding. The web server responds with a default nginx page titled "Welcome to nginx!" and does not present an SSL certificate, meaning the site is reachable only over plain HTTP.

Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. Detection services have flagged the domain: six of ninety‑three VirusTotal scanners reported it as malicious, and it appears on one external security blocklist. The domain has been taken offline and is currently blocked by the PhishDestroy mitigation system. While the presence of a brand name in the intelligence (x.com) confirms the impersonation objective, the specific payload or credential‑collection mechanism remains unknown because the site content has not been captured.

Defenders should continue to enforce blocklist rules for t-mobile.tvkfi.cc, monitor Cloudflare‑associated IP ranges for similar patterns, and update web‑filtering policies to deny HTTP traffic to the observed IP address. Incident response teams should also consider adding the domain to internal threat‑intel feeds and verify that any user‑reported attempts to access the URL are logged and investigated. Ongoing surveillance of the registrar Gname.com Pte. Ltd. may reveal additional domains created in the same window, aiding broader attribution efforts.