t-mobile[.]hagif[.]cc

The domain t-mobile.hagif.cc was registered on 2026-02-21 and is currently taken offline. DNS resolution points to the IP address 172.67.175.32, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented a TLS certificate identified as WE1, indicating the use of a publicly‑trusted certificate authority, which can aid in evading basic certificate‑based checks.

VirusTotal analysis shows that 11 out of 95 scanned security vendors flagged the domain, suggesting that multiple detection engines observed malicious characteristics, although the exact signatures are not disclosed. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service, reinforcing its classification as a malicious resource. No additional evidence such as page title, brand targeting, or specific payload details is available, leaving the precise phishing vector and lure content unknown.

Defenders should continue to block the domain at the DNS layer and consider adding the associated IP address to network‑level deny lists, recognizing that Cloudflare‑hosted IPs are shared among many unrelated services. Monitoring for new subdomains under the hagif.cc zone and for similar registration patterns may help identify future campaigns. Because the site is offline, active takedown verification is not possible, but the existing indicators warrant inclusion in threat‑intel feeds and proactive filtering rules to mitigate potential credential‑ harvesting attempts.