t-mobile[.]zkwce[.]cc

This domain is flagged as an elevated-risk phishing resource impersonating AT&T holiday promotional offers. Analysis indicates the site was designed to harvest user credentials under the pretense of exclusive deals, a common tactic in credential-theft campaigns targeting telecommunications customers. The page title, 'Holiday Deals 2025 | AT&T,' directly misrepresents the brand to exploit user trust in seasonal promotions. Infrastructure analysis reveals the domain t-mobile.zkwce.cc was registered on February 21, 2026, and resolves to IP address 188.114.96.3, hosted on AS13335 Cloudflare, Inc. in the United States. The SSL certificate is classified as WE1, a low-trust indicator often associated with ephemeral phishing domains. Detection metrics show 19 of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist. The domain is currently offline, though prior activity suggests it may re-emerge under similar infrastructure. Mitigation requires immediate action from network defenders and end users. Organizations should block the domain and its resolving IP (188.114.96.3) at the perimeter, while monitoring for related subdomains or certificate reuse. Users who interacted with the site should reset credentials for any accounts accessed during the session, particularly those tied to telecommunications services. Security teams are advised to review logs for connections to the domain or IP, as well as any anomalous authentication attempts following potential exposure. Given the domain's creation date discrepancy (2026), temporal analysis may reveal additional fraudulent registrations under the same threat actor.