t-mobile[.]wgnid[.]cc

Analysis of t-mobile.wgnid.cc indicates that the domain was registered on 21 February 2026 and is presently taken offline. DNS resolution points to the IPv6 address 2606:4700:3037::6815:1083, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site was flagged by 11 of 93 antivirus and URL scanning engines on VirusTotal, demonstrating moderate detection consensus. Gridinsoft assigned a trust score of 0 out of 100, effectively marking the domain as fully untrusted.

PhishDestroy has listed the domain as blocked, and it appears on one external security blocklist. The TLS certificate presented for the site is identified as “WE1,” a generic certificate often used by temporary or malicious services. No additional intelligence such as page title, brand targeting, or specific kit information is available at this time.

Given the combination of a recent registration, Cloudflare hosting, low trust score, multiple vendor detections, and active blocklist entries, the domain should be considered a confirmed phishing vector targeting users who might associate the “t-mobile” string with the legitimate carrier. Defensive recommendations include adding the domain and its resolved IPv6 address to network deny lists, monitoring for any future re‑registration or alternative hostings, and ensuring that endpoint protection solutions are updated to reflect the 11 vendor detections. Continuous observation of Cloudflare‑hosted sub‑domains with similar naming patterns is advised to pre‑empt re‑use of the infrastructure.