t-mobile[.]ruhfn[.]cc

Analysis of the domain t-mobile.ruhfn.cc indicates it was actively involved in a phishing campaign targeting T-Mobile users, designed to harvest login credentials. The domain, registered on February 21, 2026, resolved to the IP address 172.67.182.160, which is associated with Cloudflare, Inc. (AS13335) and located in the United States. This infrastructure choice is consistent with tactics used to obfuscate the true origin of phishing sites by leveraging Content Delivery Network (CDN) services. The domain was assigned an SSL certificate labeled WE1, a detail that may assist in tracking related certificates across other malicious domains. As of July 23, 2026, the domain has been taken offline, though its prior activity was flagged by 15 out of 93 security vendors on VirusTotal, reflecting a moderate but notable detection rate.

It also appeared on at least one security blocklist and was specifically blocked by PhishDestroy, a specialized anti-phishing service. The combination of vendor detections and blocklist inclusion suggests the domain was operational long enough to attract attention from multiple threat intelligence sources. The exact duration of its activity remains unclear, but the February registration date implies it may have been in use for several months prior to its takedown. Defenders should note that while the domain is currently offline, the infrastructure behind it—particularly the Cloudflare IP and associated SSL certificate—may still pose a residual risk.

Organizations are advised to monitor for any re-emergence of this domain or similar variations under the ruhfn.cc parent domain. Network-level blocking of the IP 172.67.182.160 may be warranted if historical traffic analysis reveals prior connections from internal systems. Additionally, security teams should review logs for any user interactions with t-mobile.ruhfn.cc between its registration date and July 2026, as compromised credentials could still be exploited even after the site’s removal.