t-mobile[.]vzgqk[.]cc

The domain t-mobile.vzgqk.cc has been identified as a brand impersonation phishing resource targeting T-Mobile customers. Analysis confirms the domain was actively employed to deceive users by mimicking official T-Mobile branding, a tactic commonly associated with credential harvesting and fraudulent account access. The domain is currently offline, though its prior activity warrants continued monitoring due to the elevated risk of re-emergence under similar infrastructure. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on February 21, 2026, a date inconsistent with legitimate T-Mobile domain timelines. The domain resolves to the IP address 104.21.32.163, hosted on AS13335 (Cloudflare, Inc.), a network frequently leveraged by threat actors to obfuscate malicious activity. Security vendor detections on VirusTotal indicate 19 of 95 engines flagged the domain as malicious, while it appears on one additional blocklist. The SSL certificate, issued by Google Trust Services (WE1), aligns with patterns observed in transient phishing campaigns, where short-lived certificates are deployed to evade detection. Current status confirms the domain is offline, though residual risk remains due to the infrastructure's historical use. Organizations and users are advised to implement proactive measures, including blocking the domain and associated IP (104.21.32.163) at the network perimeter, monitoring for similar domain registrations (e.g., typosquatting variants), and validating SSL certificates against known legitimate issuers. End-users should be educated on recognizing brand impersonation tactics, particularly those involving urgent account verification requests or unsolicited communications. Given the domain's prior association with Cloudflare infrastructure, security teams should review logs for connections to 104.21.32.163 or related AS13335 ranges during the period of activity.