t-mobile[.]erfoc[.]cc

This domain, t-mobile.erfoc.cc, is identified as a phishing site impersonating T-Mobile, a major telecommunications provider. The infrastructure is currently offline, though prior analysis confirms its use in credential harvesting campaigns targeting T-Mobile customers. The domain was operational long enough to be flagged by security systems before takedown procedures were enacted. Analysis indicates the domain was flagged by 17 of 95 security vendors on VirusTotal, a notably high detection rate for a recently established phishing resource. Registered on February 21, 2026, the domain resolved to the IPv6 address 2606:4700:3034::ac43:ae09, hosted on Cloudflare’s network (AS13335). The SSL certificate was categorized under the WE1 trust tier, a common indicator of low-reputation or automated certificate issuance. The domain appeared on one security blocklist prior to being taken offline. Infrastructure analysis reveals the domain’s reliance on Cloudflare’s hosting and CDN services, a tactic frequently observed in phishing campaigns to obfuscate origin servers and evade initial detection. Given the domain’s current offline status, no active threat is present; however, similar infrastructure may re-emerge under different subdomains or parent domains. Organizations are advised to monitor for newly registered domains containing "t-mobile" or similar brand terms, particularly those leveraging Cloudflare or other CDN providers. Network defenders should update blocklists to include this domain and its associated IP, while end users should be trained to verify URLs before entering credentials, especially for telecommunications-related login portals.