t-mobile[.]csiem[.]cc

Analysis of the domain t-mobile.csiem.cc indicates it was actively involved in a brand impersonation campaign targeting T-Mobile customers, classified as an elevated-risk threat. The domain, registered on February 21, 2026, through Gname.com Pte. Ltd., resolved to the IP address 104.21.89.13, hosted under Cloudflare's AS13335 in the United States. Nameservers magali.ns.cloudflare.com and seamus.ns.cloudflare.com were assigned, though no SSL certificate was detected. At the time of assessment on July 23, 2026, the domain was offline, returning an HTTP 522 error with the page title 'csiem.cc | 522: Connection timed out.' Security vendor detections on VirusTotal flagged the domain as malicious, with 16 of 93 engines identifying it as a phishing threat.

The domain appears on at least one security blocklist, and Gridinsoft assigned it a trust score of 0/100. PhishDestroy has blocked access to the domain, further corroborating its malicious classification. Available intelligence specifies the scam type as brand impersonation, utilizing an 'Airdrop Scam' phishing kit explicitly targeting T-Mobile. Defenders should treat this domain as confirmed malicious infrastructure.

Organizations are advised to block the domain and its resolving IP (104.21.89.13) at the network perimeter. Security teams should review logs for connections to t-mobile.csiem.cc or the associated IP to identify potentially compromised devices. Given the use of Cloudflare, additional related subdomains or domains under the same registrar (Gname.com Pte. Ltd.) may warrant investigation. No further content analysis of the phishing page is available at this time.