t-mobile[.]umlbx[.]cc

Analysis shows that the domain t-mobile.umlbx.cc was created on February 21 2026 and is currently listed as taken offline. DNS resolution points to the IPv6 address 2606:4700:3033::6815:1603, an asset owned by AS13335 under Cloudflare, Inc., with the hosting location identified as the United States. The SSL certificate observed on the host is labeled WE1, a standard certificate without extended validation, which does not provide additional trust signals. VirusTotal records indicate that 14 of 95 security vendors have flagged the domain as malicious, demonstrating a measurable level of consensus among detection engines.

The domain appears on one public security blocklist and has been actively blocked by the PhishDestroy remediation service, confirming that at least one dedicated anti‑phishing solution has taken action against it. No page title or content snapshot is available in the current intelligence, so the exact visual or functional characteristics of the landing page remain unverified. The combination of a recent registration date, Cloudflare‑hosted infrastructure, a flagged SSL certificate, and multi‑vendor detections aligns with the classification of a generic phishing operation targeting users who might be lured by the "t‑mobile" naming pattern. Risk is elevated, reflecting the potential for credential harvesting or credential‑stealing payload delivery.

Defenders should add t-mobile.umlbx.cc to DNS and proxy blocklists, enforce denial of outbound traffic to the resolved IPv6 address, and monitor the underlying Cloudflare IP range for any re‑use of the same infrastructure. Ongoing review of VirusTotal and other aggregation services is advised to capture any shift in detection counts. Although the site is offline, the underlying hosting environment can be reused, so continuous threat‑intel monitoring and proactive filtering remain essential.