t-mobile[.]tvkfq[.]cc

The domain t-mobile.tvkfq.cc was created on February 21, 2026 and is registered through Gname.com Pte. Ltd. Its authoritative nameservers are jakub.ns.cloudflare.com and kinsley.ns.cloudflare.com, indicating that the domain is hosted behind Cloudflare's edge network. DNS resolution points to IP address 172.67.142.7, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was presented when the site was accessed, and the HTTP response returned the generic page title "Welcome to nginx!", suggesting a default web server configuration rather than a brand‑specific landing page. The site is classified as a brand impersonation campaign targeting the brand x.com, and the current operational status is offline, having been taken down prior to this analysis.

VirusTotal scans identified the domain as malicious in 13 of 93 antivirus or URL scanners, providing independent confirmation of suspicious activity. The Gridinsoft trust score of 0 out of 100 reinforces the low confidence in the domain's legitimacy. It appears on a single security blocklist and has been explicitly blocked by the PhishDestroy filtering service. While the available evidence confirms the domain’s involvement in a brand‑impersonation scheme, details such as the specific phishing kit, payload, or victim interaction flow remain unknown due to the offline status and lack of observed content.

Defenders should continue to block the domain at network and endpoint layers, monitor DNS queries for the associated IP address and nameserver pair, and include the domain in URL filtering policies. Additional investigation into any associated subdomains or related Cloudflare‑hosted assets is advisable, as threat actors often reuse infrastructure across campaigns. Continuous re‑evaluation of detection feeds is recommended to capture any resurgence or re‑hosting of the malicious content.