t-mobile[.]tdkshcw[.]cc

Analysis of the domain t-mobile.tdkshcw.cc, registered on February 3, 2026, through Gname.com Pte. Ltd., reveals infrastructure consistent with brand impersonation targeting X.com. The domain resolved to IP 172.67.145.3, hosted on Cloudflare’s network (AS13335) in the United States, and was flagged by 16 of 93 security vendors on VirusTotal. Detection by PhishDestroy and inclusion on one security blocklist further confirm its malicious classification. The page title, 'Welcome to nginx!', suggests a default server banner rather than a fully deployed phishing kit, though the exact content remains unanalyzed.

No SSL certificate was present, increasing the likelihood of interception or detection by browser security mechanisms. Infrastructure analysis indicates the use of nameservers A.SHARE-DNS.COM and B.SHARE-DNS.NET, a pattern observed in other low-reputation domains. Gridinsoft’s trust score of 0/100 aligns with the domain’s classification as a brand impersonation scam.

While the domain is currently offline, defenders should monitor for re-emergence under the same registrar or IP range. Organizations targeted by X.com-themed phishing campaigns are advised to block the domain and IP at perimeter defenses, and to review logs for prior connections. The absence of a custom SSL certificate and the generic nginx banner may indicate an early-stage or abandoned campaign, but the detection count and blocklist inclusion warrant continued vigilance.