t-mobile[.]pbuof[.]cc

The phishing domain t-mobile.pbuof.cc, which targets T-Mobile users, has been taken down. Despite its offline status, it was flagged by 12 out of 93 vendors on VirusTotal, indicating its malicious nature. The domain was also included in one public blocklist, specifically PhishDestroy's. It was hosted on IP 188.114.96.3 in the US, under Cloudflare, Inc. (AS13335). The domain had an SSL certificate issued by WE1, and its platform risk score was 73 out of 100.

Registered on February 21, 2026, t-mobile.pbuof.cc was detected by PhishDestroy just five days later, on February 26, 2026. This quick detection is crucial in the fight against phishing, as it helps mitigate the potential damage these domains can cause. The domain's rapid inclusion in blocklists and detection by multiple security vendors highlights the effectiveness of early threat identification.

Phishing domains like t-mobile.pbuof.cc often exploit the time gap between their registration and the propagation of detection data across antivirus databases. PhishDestroy's pipeline operates upstream of many AV vendors, capturing threats during this critical pre-detection window. The domain's presence on VirusTotal and its inclusion in blocklists demonstrate the ongoing need for vigilance and proactive measures in cybersecurity.