t-mobile[.]com-asf[.]com

Analysis of t-mobile.com-asf.com shows the domain was registered on 21 February 2026 and subsequently resolved to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The hosting provider is a well‑known CDN often abused for malicious traffic. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy feed, indicating that at least one sinkhole or detection network has observed abusive activity. VirusTotal records show that ten of ninety‑three scanning engines returned a malicious verdict, providing independent confirmation that the site was flagged as dangerous.

An SSL certificate identified as “WE1” was observed, but the certificate details do not appear to correspond to a legitimate brand and are typical of automatically issued certificates for short‑lived infrastructure. The domain’s current status is reported as offline, suggesting that the malicious site has been taken down or is no longer serving content. Because the page title, brand target, and content have not been harvested, the precise phishing lure cannot be confirmed.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor the associated IP 188.114.97.3 for any resurgence of malicious activity, and update threat‑intel feeds with the observed indicators. Organizations that use Cloudflare services should verify that this IP is not part of their legitimate traffic. Given the elevated risk rating, security teams should treat any future re‑appearance of the domain as a high‑confidence indicator of phishing infrastructure.