t-mobile[.]xgokds[.]cc

The domain t-mobile.xgokds.cc was registered on February 21, 2026 and is presently listed as offline. Infrastructure analysis shows it resolves to the IP address 172.67.216.83, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site was served over TLS using a certificate identified as WE1.

Defensive feeds indicate that the domain has been blocked by the PhishDestroy service and appears on a single security blocklist. VirusTotal records reveal that 16 of 93 scanning engines flagged the domain as malicious, confirming a consensus of concern among automated detectors. The limited blocklist presence suggests that the domain’s exposure may be recent or narrowly targeted.

Defenders should continue to monitor the host IP for any re‑activation, enforce outbound filtering for connections to Cloudflare‑hosted IP ranges associated with this domain, and update internal blacklists to include t-mobile.xgokds.cc. Because the domain is already taken offline, immediate incident response actions such as sink‑holing are not required, but threat‑intel teams should keep the indicator of compromise under watch in case the adversary re‑hosts the payload on a different domain. The lack of additional public context, such as page titles or brand references, limits deeper attribution, and analysts should treat the domain as a generic phishing indicator until further evidence emerges.