t-mobile[.]sflby[.]cc

This domain, t-mobile.sflby.cc, operates as a credential theft platform impersonating T-Mobile’s official login portals. Analysis indicates the site is designed to harvest user credentials, including usernames, passwords, and potentially multi-factor authentication codes, by presenting a fraudulent replica of T-Mobile’s authentication interface. The domain leverages brand-specific visual elements and URL obfuscation techniques to deceive victims into submitting sensitive account details, which are then exfiltrated to attacker-controlled infrastructure for unauthorized access or financial exploitation. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on January 29, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with malicious activity. It resolves to IP address 172.67.154.174, hosted on AS13335 (Cloudflare, Inc.), a network commonly abused for phishing due to its anonymization capabilities. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing and PhishDestroy have both classified it as phishing. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued by Google Trust Services (WE1), does not mitigate the underlying threat. The page title, 'Suspected phishing site | Cloudflare,' further confirms its deceptive nature, as legitimate T-Mobile pages do not carry such warnings. Users who have visited t-mobile.sflby.cc or entered credentials on the site should immediately take corrective action. First, reset passwords for T-Mobile accounts and any other services where identical credentials may have been reused. Enable multi-factor authentication (MFA) using app-based or hardware tokens, avoiding SMS-based methods if previously configured. Monitor T-Mobile accounts for unauthorized transactions, device additions, or changes to account settings. If financial or personal data was submitted, report the incident to relevant authorities and consider placing a fraud alert on credit files. Network administrators should block the domain and its resolving IP (172.67.154.174) at the perimeter to prevent further exposure.