t-mobile[.]tvkfa[.]cc

Analysis of t-mobile.tvkfa.cc indicates it has been deployed as a brand‑impersonation campaign targeting the x.com brand. The domain was registered through Gname.com Pte. Ltd. on 21 February 2026 and is hosted on Cloudflare’s network (ASN 13335). DNS resolution points to the IP address 188.114.96.3, which is located in the United States and associated with Cloudflare, Inc. The authoritative name servers are jakub.ns.cloudflare.com and kinsley.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. No TLS certificate is presented; HTTP requests return the default nginx landing page with the title “Welcome to nginx!”, indicating that the site is either an empty placeholder or intentionally serving a generic response.

Reputation checks show a Gridinsoft trust score of 0 out of 100, reflecting a complete lack of confidence in the host. VirusTotal analysis reports that 5 of 93 security vendors have flagged the domain as malicious, and the domain appears on one external blocklist. The phishing‑defense platform PhishDestroy has already taken the domain offline, and the current status is listed as “taken offline”. Uncertainties remain regarding the precise payload or phishing page that may have been hosted before takedown, as no page content beyond the generic nginx title has been captured.

Defenders should continue to monitor the IP address 188.114.96.3 for any resurgence of malicious activity, enforce outbound filtering for the full hostname t-mobile.tvkfa.cc, and add the domain to internal blocklists. Because the domain uses Cloudflare’s infrastructure, any future re‑creation will likely reuse the same CDN footprint; thus, threat‑intel feeds should be queried for new sub‑domains or similar patterns. Regularly updating URL filtering rules and corroborating external threat‑intel with internal logs will reduce the risk of users encountering a repeat of this impersonation attempt.