t-mobile[.]yedpv[.]cc

This domain, t-mobile.yedpv.cc, is identified as a credential phishing site targeting T-Mobile customers. Analysis indicates the infrastructure was designed to mimic legitimate T-Mobile login portals, likely to harvest user credentials and sensitive account information. No specific drainer kit signatures were detected, but the domain follows common phishing patterns, including brand impersonation and SSL certificate misuse for perceived legitimacy. Technical indicators reveal the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., an uncommon registrar for legitimate corporate domains. It resolves to IP address 104.21.28.242, hosted on Cloudflare's network (AS13335), a frequent choice for threat actors due to its anonymizing capabilities. VirusTotal detection shows 18 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is associated with an SSL certificate issued by Google Trust Services (WE1). The page title, 'yedpv.cc | 522: Connection timed out,' suggests recent takedown or server misconfiguration. Current status indicates the domain is offline, likely due to remediation efforts by hosting providers or security teams. However, residual risk remains as the domain's infrastructure could be reactivated or repurposed. Organizations are advised to block the domain and IP at perimeter defenses, monitor for credential reuse attempts, and educate users on identifying phishing attempts. Continuous monitoring of related infrastructure (e.g., newly registered domains under the same registrar or IP range) is recommended to preempt further campaigns.