t-mobile[.]knreb[.]cc

Analysis of the domain t-mobile.knreb.cc indicates it is a brand impersonation scam targeting T-Mobile customers, classified as an elevated-risk threat. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd. and is currently offline, returning a 522 connection timeout error with the page title 'knreb.cc | 522: Connection timed out.' Infrastructure analysis reveals the domain uses Cloudflare nameservers (paityn.ns.cloudflare.com and syeef.ns.cloudflare.com) and resolves to the IP address 172.67.204.48, hosted on Cloudflare's network (AS13335) in the United States. No SSL certificate is present, increasing the risk of unencrypted communications.

Security vendor detections are notable: 13 of 93 engines on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist, including PhishDestroy. The domain is linked to an 'Airdrop Scam' phishing kit, a tactic commonly used to deceive users into divulging personal or financial information under the guise of a promotional giveaway. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification.

While the domain is currently offline, defenders should treat it as a confirmed threat due to its infrastructure, detection history, and association with a known phishing kit. Organizations are advised to block the domain at the DNS or proxy level, monitor for related subdomains or IPs, and alert users to the risks of interacting with unsolicited T-Mobile-themed promotions. The exact content of the site is not yet analyzed, but the available evidence strongly supports its classification as a brand impersonation scam.