t-mobile[.]ydxhg[.]cc

The domain t-mobile.ydxhg.cc was registered on January 07, 2026 through Gname.com Pte. Ltd. and is hosted on the Cloudflare network (AS13335) with the IP address 104.21.59.227 located in the United States. DNS resolution is performed by the authoritative name servers A.SHARE-DNS.COM and B.SHARE-DNS.NET. The site presented a TLS certificate identified as WE1, but the service is currently taken offline. Threat intelligence indicates that the domain is being used for a generic phishing campaign; this classification is supported by the fact that 17 of 93 security vendors on VirusTotal have flagged the domain as malicious.

Additional defensive sources have corroborated the risk: the domain is listed on one security blocklist and has been actively blocked by the PhishDestroy feed. Reputation scoring from Gridinsoft assigns the domain a trust score of 0 out of 100, reinforcing the malicious assessment. No further details such as page title, brand target, or specific phishing kit have been released, leaving the exact content of the lure unknown.

Defenders should continue to block the domain at the network perimeter and update proxy and DNS filtering rules to deny resolution of 104.21.59.227 for any internal client. Monitoring for any re‑hosting attempts on alternative IPs or similar sub‑domains issued by the same registrar is advised, as threat actors may attempt to re‑activate the campaign after takedown. Incident response teams should also log the domain in threat intelligence platforms, reference the 17 vendor detections, and note the current offline status while maintaining vigilance for potential resurgence.