t-mobile[.]zfgor[.]cc

Analysis of t-mobile.zfgor.cc, registered on 21 February 2026 through Gname.com Pte. Ltd., shows an active high‑risk brand‑impersonation infrastructure targeting the T‑Mobile brand. The domain resolves to 104.21.39.121, an address owned by AS13335 Cloudflare, Inc., and is served behind Cloudflare’s edge network with HTTP/3 enabled. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming that encryption is in place but does not vouch for legitimacy. The site returns HTTP 200 and the page title displayed by the server is “zfgor.cc | 522: Connection timed out”, indicating that the underlying payload may be a placeholder or a timed‑out response rather than the phishing content itself. The infrastructure uses the nameservers matias.ns.cloudflare.com and paige.ns.cloudflare.com, both Cloudflare‑managed. Security telemetry flags the domain as malicious.

Sixteen of ninety‑three VirusTotal scanners have identified it as malicious, and it appears on at least one public blocklist. PhishDestroy has explicitly blocked the domain, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The observed scam kit is labeled “Airdrop Scam”, which aligns with recent social‑engineering campaigns that lure victims with fraudulent airdrop offers. The brand target is listed as T‑Mobile, confirming that the operator is being impersonated. While the page title does not reveal the exact phishing landing page, the combination of Cloudflare hosting, a recent registration date, low trust score, and multiple vendor detections strongly suggests that the domain is being used to host a credential‑stealing or fraud page.

The exact content of the page has not been publicly captured, leaving the specific tactics (e.g., credential capture form, malicious download) uncertain. Defenders should add the domain to internal blocklists, monitor DNS queries for the 104.21.39.