t-mobile[.]htnbi[.]cc

This domain, t-mobile.htnbi.cc, was registered on 21 February 2026 and is currently listed as offline. DNS resolution points to the IPv6 address 2606:4700:3034::6815:4ab3, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The site presented an SSL certificate identified as WE1, indicating the use of a valid TLS layer despite the domain’s malicious purpose.

Reputation services have recorded nine positive detections out of ninety‑three vendors on VirusTotal, and the domain appears on a single external blocklist. PhishDestroy has explicitly blocked the domain, confirming its classification as a generic phishing campaign targeting credential theft. No additional intelligence such as page title, brand references, or kit fingerprints has been released, leaving the exact content of the hosted page unverified.

The limited evidence suggests the domain was employed as part of a short‑lived credential harvesting operation that was taken down shortly after deployment. Defenders should continue to enforce DNS‑level denial for the IPv6 address and the domain name, incorporate the indicator into web‑proxy and firewall rule sets, and monitor for any re‑registration attempts or similar sub‑domains under the htnbi.cc parent zone. Ongoing vigilance is recommended, as the underlying infrastructure—Cloudflare’s CDN—can be re‑used by future campaigns with minimal operational friction.