t-mobile[.]ygier[.]cc

Analysis of t-mobile.ygier.cc indicates that the domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and is currently taken offline. The authoritative name servers are rosa.ns.cloudflare.com and seamus.ns.cloudflare.com, pointing the domain to the Cloudflare edge address 172.67.197.171, which resolves to an AS13335 location in the United States. The HTTP response presents the generic title “Welcome to nginx!” and no TLS certificate is offered, suggesting the site is hosted without encryption. The domain appears on a single security blocklist and has been explicitly flagged by PhishDestroy.

VirusTotal reports that 15 of 93 scanning engines classify the host as malicious, reinforcing the suspicion of abusive activity. Gridinsoft assigns a trust score of 0 out of 100, indicating a lack of reputation. The combination of a recent registration, lack of TLS, low trust score, detection by multiple vendors, and inclusion on a phishing‑focused blocklist aligns with the classification of a generic phishing infrastructure.

However, the limited visible content prevents confirmation of the exact phishing payload or targeted brand. Defenders should add the domain and its resolving IP to block lists, monitor for any re‑activation, and consider tightening outbound filtering for traffic to Cloudflare edge nodes associated with this address. Ongoing observation of any new DNS records or SSL provisioning is recommended to detect possible re‑use.