t-mobile[.]rslwm[.]cc

t-mobile.rslwm.cc was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolves to 104.21.28.19, an address owned by Cloudflare (AS13335) in the United States. The domain is served by the Cloudflare name servers alice.ns.cloudflare.com and james.ns.cloudflare.com. No TLS certificate is presented; HTTPS connections terminate with a 522 Connection timed out page, as reflected in the observed page title “rslwm.cc | 522: Connection timed out”. The site is currently offline, which limits direct content analysis, but multiple security controls have flagged it. It appears on one public blocklist and is actively blocked by PhishDestroy.

Gridinsoft assigns a trust score of 0 out of 100. VirusTotal reports that 13 of 93 scanning engines flag the domain as malicious. The underlying phishing kit has been identified as the “Airdrop Scam” kit, and the campaign is categorized as brand impersonation targeting the T‑Mobile brand. Evidence indicates that the threat actors are leveraging a reputable CDN to mask the true hosting location, a common tactic to evade attribution.

While the exact payload or credential‑harvesting pages cannot be confirmed due to the offline status, the combination of blocklist listing, low trust score, multiple vendor detections, and the presence of a known phishing kit provides strong confidence that the domain is being used for fraudulent purposes. Defenders should add t-mobile.rslwm.cc to URL and DNS blocklists, enforce TLS inspection policies that drop connections lacking valid certificates, and monitor for any future resolution changes or new sub‑domains under the same registrar. Email security gateways should be tuned to flag messages referencing T‑Mobile with suspicious links, and incident response teams should treat any observed traffic to this IP as hostile. Continuous threat‑intel feed updates are recommended to capture any re‑activation attempts.