t-mobile[.]pxdta[.]cc

t-mobile.pxdta.cc was registered on 21 February 2026 and resolves to the Cloudflare address 172.67.149.71, which is associated with ASN 13335 in the United States. The domain is currently taken offline, and the phishing‑remediation service PhishDestroy has confirmed that the site has been blocked. The SSL certificate presented by the host is identified as “WE1”, indicating a generic certificate that does not match the brand implied by the sub‑domain. VirusTotal analysis shows that 11 of 93 scanning engines flagged the domain as malicious, reinforcing the suspicion of phishing activity.

The domain appears on a single security blocklist, suggesting limited but existing detection coverage. Infrastructure analysis indicates that the use of a Cloudflare edge network provides anonymity for the operator while leveraging the reputation of a widely trusted CDN. The combination of a recently created domain, a generic TLS certificate, and a modest detection count is consistent with a short‑lived phishing campaign that targets users of the T‑Mobile brand. No public page title or content snapshot is available, and the exact phishing lure has not been recovered, leaving the specific content of the fraudulent page uncertain.

Defenders should continue to block the IP address 172.67.149.71 at the network perimeter and add t-mobile.pxdta.cc to URL filtering policies. Because the domain is hosted on Cloudflare, future sub‑domains may be spun up using the same infrastructure; monitoring for newly registered domains that resolve to the same ASN or share the “pxdta.cc” suffix is advisable. Updating endpoint and email security solutions with the observed indicator set, including the domain name, IP address, and certificate fingerprint, will help prevent user exposure. Organizations should also consider sharing the indicator set with threat‑sharing platforms to improve collective visibility.