t-mobile[.]zwpvj[.]cc

This domain is flagged as a credential harvesting phishing site targeting mobile telecommunications users. Analysis indicates an elevated risk level due to its specific focus on impersonating a major carrier’s login portal, designed to capture account credentials and personal data. The domain is currently offline, but prior activity and infrastructure details warrant further scrutiny for potential re-emergence or related campaigns.

Infrastructure analysis reveals the domain t-mobile.zwpvj.cc was registered through Gname.com Pte. Ltd. on February 21, 2026, and resolves to the IP address 104.21.25.215, hosted on Cloudflare’s network (AS13335). Detection metrics show 17 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist and is explicitly blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend legitimacy to phishing pages. The page title, "zwpvj.cc | 522: Connection timed out," suggests the site was recently taken offline, likely due to detection or enforcement actions.

Mitigation steps for credential harvesting threats include immediate blocking of the domain and associated IP (104.21.25.215) at the network perimeter. Organizations should monitor for related domains registered through the same registrar (Gname.com Pte. Ltd.) or resolving to Cloudflare IPs, as these may indicate follow-on campaigns. End users should be educated on identifying phishing attempts, particularly those impersonating telecommunications providers, and encouraged to verify URLs before entering credentials. If credentials were entered on this site, affected accounts should be secured immediately, including password resets and multi-factor authentication enforcement.