t-mobile[.]ykclf[.]cc

Analysis of t-mobile.ykclf.cc indicates a phishing domain targeting T-Mobile users, currently offline as of July 24, 2026. The domain was registered on February 21, 2026, and resolves to IP address 104.21.6.98, hosted on Cloudflare's infrastructure (AS13335). Security vendors flagged this domain, with 17 of 93 engines on VirusTotal detecting malicious activity, though the exact nature of the threat remains unverified through direct inspection. The domain appears on at least one security blocklist and was blocked by PhishDestroy, reinforcing its classification as a phishing threat.

The SSL certificate (WE1) provides no additional trust indicators, and Gridinsoft assigns a trust score of 0/100, further confirming its high-risk status. Infrastructure analysis reveals the domain leveraged Cloudflare's CDN, a common tactic to obscure hosting origins and evade takedowns. The domain's creation date suggests it was active for approximately five months before being taken offline, though no evidence confirms whether it was operational during that period or remained dormant.

Defenders should treat this domain as a confirmed phishing indicator, particularly for campaigns impersonating T-Mobile. Network security teams are advised to block the domain and its resolving IP at perimeter defenses, while monitoring for related subdomains or newly registered lookalike domains. No additional brand-specific artifacts or phishing kit identifiers are available at this time, limiting further attribution.