t-mobile[.]nlpdt[.]cc

Domain t-mobile.nlpdt.cc is assessed as generic_phishing infrastructure designed for credential harvesting via a fake login impersonation vector targeting the T-Mobile brand. The observed page behavior aligns with login-style deception patterns typically used to capture authentication credentials. The domain is currently offline, indicating disruption of active phishing delivery.

Technical telemetry shows the domain resolves to IP 188.114.97.3 hosted under AS13335 Cloudflare, Inc. The domain was created on February 21, 2026, indicating very recent infrastructure deployment. Security analysis records 17 of 95 VirusTotal vendors flagging the domain as malicious. It appears on 1 independent security blocklist and is served via SSL certificate WE1. Registrar information is not specified in the available dataset.

Despite being taken offline, the infrastructure exhibits characteristics consistent with short-lived phishing campaigns leveraging CDN-backed hosting to obscure origin attribution. The moderate detection rate (17/95) suggests partial evasion effectiveness prior to takedown. Recommended response actions include maintaining block rules for the domain and associated IP 188.114.97.3, reviewing authentication logs for any user interaction during the active window, and monitoring for reuse of similar subdomain patterns under nlpdt.cc. Continued tracking of certificate reuse and Cloudflare-associated hosting patterns is advised for early identification of related campaigns.