t-mobile[.]pgrkt[.]cc

Analysis of t-mobile.pgrkt.cc indicates a high‑risk brand impersonation campaign targeting the x.com brand. The domain was registered on February 21, 2026 through Gname.com Pte. Ltd. and resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. The domain is served via Cloudflare nameservers (natasha.ns.cloudflare.com and ram.ns.cloudflare.com) but does not present an SSL/TLS certificate, exposing any traffic to potential interception. The HTTP response includes the generic page title "Welcome to nginx!", offering no indication of malicious landing content.

Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal scans show that 11 of 95 antivirus engines flag the domain, reinforcing the suspicion of malicious use. PhishDestroy has already blocked the domain, and the overall status is listed as offline, suggesting the operators have taken the site down or are rotating infrastructure.

While the exact payload or credential‑harvesting page is not yet captured, the combination of brand impersonation labeling, low trust score, multiple vendor detections, and blocklist presence provides sufficient evidence for defensive action. Security teams should add t-mobile.pgrkt.cc to local blocklists, monitor for any future DNS resolution changes, and enforce strict outbound filtering to prevent user interaction with this host. Continuous threat‑intel feeds should be consulted for re‑appearance, and users should be advised that any unsolicited communications purporting to originate from the x.com brand that reference this domain are fraudulent.