t-mobile[.]lvdcf[.]cc

t-mobile.lvdcf.cc was registered on 21 February 2026. Within weeks it appeared on a security blocklist and was subsequently taken offline, as indicated by the PhishDestroy block. DNS resolution points to 172.67.200.144, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The domain’s TLS certificate, identified as WE1, was observed in the initial scan.

VirusTotal analysis recorded 12 detections out of 93 scanned scanners, confirming that multiple security products consider the domain malicious. The limited blocklist presence (one listing) and the offline HTTP status suggest that the phishing infrastructure was short‑lived, possibly used for a targeted campaign and then abandoned. No public page title, brand targeting, or kit identification has been released, so the exact phishing template and victim lure remain unknown.

Given the recent creation date, the association with Cloudflare’s edge network, and the confirmed detections, defenders should add the domain and its resolved IP to outbound and inbound filtering rules, cite the VirusTotal detection count in automated blocking policies, and monitor for any re‑registration of the same second‑level domain or similar sub‑domains. Continuous enrichment of threat‑intel feeds for new listings of t-mobile.lvdcf.cc or related C‑NAMEs is recommended. Until further evidence surfaces, the domain should be treated as a confirmed phishing indicator with elevated risk.