t-mobile[.]vtoifdn[.]cc

The domain t-mobile.vtoifdn.cc is designed to impersonate the T-Mobile brand, posing as a phishing or credential harvesting site. The threat it presents is the collection of personal and financial information from users who believe they are interacting with a legitimate T-Mobile service. The site uses a deceptive domain name that mimics the official T-Mobile brand to trick visitors.

Technical evidence from VirusTotal shows 13 detections out of 95 vendors, with flags from ADMINUSLabs, alphaMountain.ai, Cluster25, CRDF, and CyRadar. The domain is associated with one blocklist entry. It is hosted on IP address 188.114.96.3, located in the United States, and assigned to AS13395 Cloudflare, Inc. The domain was created on February 21, 2026, and uses an SSL certificate identified as WE1.

The domain is currently offline and down, with a DOM risk score of 73, indicating a high risk level. Its offline status reduces immediate threat, but the domain remains flagged for malicious activity and could be reactivated or used for future attacks.