t-mobile[.]thkeg[.]cc

t-mobile.thkeg.cc is a newly registered domain (created 21 February 2026) that has been observed impersonating the brand x.com. The domain resolves to the Cloudflare‑owned address 172.67.200.99, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Authoritative nameservers are liberty.ns.cloudflare.com and nitin.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. HTTP requests to the host return the default nginx page with the title “Welcome to nginx!” and no SSL certificate is presented, indicating that the site is served over plain HTTP without encryption. Registration was performed through Gname.com Pte. Ltd., a registrar known to host a variety of malicious domains.

Analysis of threat intelligence feeds shows the domain is classified as a brand‑impersonation campaign targeting x.com. It has been taken offline at the time of this report (24 July 2026) and was previously blocked by the PhishDestroy filtering service. The Gridinsoft trust score for the domain is 0 out of 100, reflecting an extremely low reputation. VirusTotal has recorded detections from 11 of 93 scanning engines, confirming that multiple security vendors consider the host malicious. The domain appears on a single public blocklist, reinforcing its malicious status.

While the current HTTP response is limited to a generic nginx welcome page, the combination of a recent registration date, Cloudflare front‑end, lack of TLS, low trust score, and multiple vendor detections strongly suggests the infrastructure was intended to host credential‑stealing or other fraudulent pages mimicking x.com. No additional evidence such as Safe Browsing alerts, OTX indicators, or detailed payload analysis is available at this time. Defenders should continue to block t-mobile.thkeg.cc at DNS and proxy layers, monitor the associated IP address 172.67.200.99 for any re‑use, and consider adding the host to internal blocklists.