t-mobile[.]hblek[.]cc

Analysis of t-mobile.hblek.cc shows a short‑lived domain created on 21 February 2026 that was actively serving phishing content before being taken offline. The site presented a valid SSL certificate identified as WE1, indicating the use of a publicly trusted certificate to lend credibility to the malicious page. VirusTotal scans recorded nine detections out of ninety‑three participating security vendors, confirming that multiple independent engines flag the domain as malicious.

DNS resolution points to the IPv6 address 2606:4700:3033::6815:1f08, which is hosted within Cloudflare’s network (AS13335) and located in the United States. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, reinforcing its classification as a phishing infrastructure. The current status is offline, suggesting the operators have either abandoned this particular host or are rotating infrastructure to evade takedown.

Defenders should continue to block the domain at perimeter and proxy layers, monitor for any re‑registration of the same second‑level name or similar sub‑domains under the hblek.cc zone, and watch for new Cloudflare‑hosted IPv6 addresses that match the observed pattern. Given the elevated risk rating, security teams should also update URL filtering and email security policies to include this indicator of compromise, and consider sharing the indicator set with threat‑intel sharing platforms to aid broader community detection.