t-mobile[.]cniek[.]cc

The domain t-mobile.cniek.cc was registered on February 21, 2026 and is currently listed as offline. Infrastructure analysis shows the domain resolves to the IP address 188.114.96.3, which belongs to AS13335 operated by Cloudflare, Inc., placing the host in the United States. An SSL certificate identified as WE1 is present on the hostname, indicating encrypted HTTPS connectivity, but the certificate alone does not attest to legitimacy. Threat intelligence indicates that 12 of 93 security vendors on VirusTotal have flagged the domain as malicious, demonstrating a moderate level of consensus among scanners.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service, confirming that at least one defensive product has taken action against it. In addition, Gridinsoft assigns a trust score of 0 out of 100, reflecting a clear lack of confidence in the site’s safety. No public page title, Safe Browsing status, or Open Threat Exchange (OTX) data are available for this domain, and the evidence base does not include any observed payloads or campaign details.

Given the combination of a recent registration, Cloudflare hosting, a low trust score, multiple vendor detections, and active blocklist inclusion, defenders should treat t-mobile.cniek.cc as a high‑confidence phishing indicator. Recommended actions include ensuring the domain is added to network deny lists, confirming that endpoint and web filtering solutions block any resolution attempts, and monitoring for any future re‑hosting attempts that might reuse the same lexical pattern. Continuous re‑evaluation is advised, as the offline status may change if the operators reactivate the site.