t-mobile[.]ohklq[.]cc

This domain t-mobile.ohklq.cc was registered on February 21, 2026 and currently resolves to 104.21.87.205, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The site presents the generic HTTP title “Welcome to nginx!” and does not serve an SSL certificate, indicating a lack of transport encryption. The domain is listed under a single public security blocklist and has been actively blocked by the PhishDestroy filtering service. The registrar for the domain is Gname.com Pte. Ltd., and the authoritative nameservers are gerardo.ns.cloudflare.com and riya.ns.cloudflare.com.

The malicious activity is classified as brand impersonation of x.com, matching the intelligence tag “Scam type: Brand Impersonation”. VirusTotal analysis shows that 12 of 95 scanned security vendors flagged the domain as malicious, reinforcing the suspicion that the infrastructure is being used for credential harvesting or other fraudulent purposes. Gridinsoft assigns a trust score of 0 out of 100, reflecting an extremely low reputation. The domain’s current operational status is offline, suggesting that the campaign may have been taken down or is temporarily dormant.

Defenders should add 104.21.87.205 to network blocklists, enforce DNS filtering for t-mobile.ohklq.cc, and monitor any future resolution to Cloudflare IP ranges that match this pattern. Continuous observation of the registrar Gname.com and the associated nameservers is recommended, as they may be reused for subsequent impersonation attempts. Organizations that rely on the x.com brand should alert users to the possibility of fraudulent communications referencing the t-mobile.ohklq.cc domain and reinforce safe‑login practices. Incident response teams should retain this indicator set for threat‑intel correlation and consider sharing the domain hash with industry sharing platforms.