t-mobile[.]rfxpc[.]cc

Analysis of t-mobile.rfxpc.cc identifies it as a credential-phishing domain targeting T-Mobile customers. The domain was registered on February 21, 2026, and resolved to IP 172.67.189.153, hosted on Cloudflare infrastructure (AS13335) in the United States. As of July 23, 2026, the site is offline, though its prior activity triggered detections from 13 of 93 security vendors on VirusTotal and inclusion on at least one security blocklist, with PhishDestroy confirming its malicious classification.

The SSL certificate (WE1) offers no additional trust indicators, consistent with short-lived phishing domains. No specific phishing kit or page content has been analyzed, but the subdomain structure and brand reference strongly suggest an intent to harvest T-Mobile account credentials. Defenders should treat this domain as compromised and prioritize blocking it at DNS and proxy layers.

Historical WHOIS data may reveal additional connected infrastructure, though current registrar details remain unconfirmed. Given the domain's offline status, further forensic analysis of associated IPs or certificates could uncover related campaigns, particularly if the same Cloudflare IP was reused across multiple phishing sites.