t-mobile[.]wbndg[.]icu

Analysis of t-mobile.wbndg.icu shows that the domain was registered on 12 January 2026 through Gname.com Pte. Ltd. and is hosted behind Cloudflare (ASN 13335) with the public address 104.21.66.212 located in the United States. The domain resolves to two authoritative name servers, A.SHARE-DNS.COM and B.SHARE-DNS.NET, and presents an SSL certificate identified as WE1. VirusTotal has recorded 14 of 93 scanning engines flagging the domain, indicating a moderate level of detection across multiple vendors. The domain appears on a single public blocklist and has been specifically blocked by the PhishDestroy service.

The threat classification in the supplied intelligence is generic phishing, and the current operational status is offline. The evidence confirms that the infrastructure is typical of fast‑flux or proxy‑based phishing campaigns that leverage Cloudflare’s CDN to hide the true origin of the malicious payload. However, no detailed page content, HTTP response codes, or Safe Browsing verdicts are available, leaving the exact lure and credential‑harvesting mechanism undisclosed. The lack of additional public blocklist listings or wider vendor consensus suggests that detection is still emerging.

Defenders should treat any traffic to t-mobile.wbndg.icu as malicious. Network controls ought to block the IP address 104.21.66.212 and the associated CIDR ranges owned by ASN 13335. Email gateways and web proxies should enforce URL filtering based on the full domain name, and security information and event management (SIEM) rules should be updated to generate alerts on DNS queries for the domain or its name servers. Continuous monitoring of VirusTotal and other reputation services is recommended to capture any changes in detection status, and incident response teams should be prepared to investigate potential credential theft attempts that reference the T‑Mobile brand.