t-mobile[.]sawye[.]cc

t-mobile.sawye.cc was observed in multiple threat feeds as a phishing infrastructure targeting users of a major mobile carrier. The domain was registered on 21 February 2026 and resolves to the Cloudflare address 172.67.212.15, an IP range owned by AS13335 in the United States. The SSL certificate presented for the host is identified as “WE1”, which is commonly associated with short‑lived certificates used by malicious operators. VirusTotal records show that 12 of 95 scanning engines have flagged the domain as malicious, indicating a moderate level of detection across the security community.

The domain appears on a single public blocklist and is actively blocked by the PhishDestroy service, confirming that at least one reputable anti‑phishing repository has catalogued it. Current network measurements indicate that the host is offline, which suggests the operators have taken the site down or are rotating infrastructure. No public page title, brand reference, or additional content has been disclosed, so the exact visual or functional characteristics of the site remain unknown.

Defenders should continue to monitor the IP address 172.67.212.15 for any re‑appearance of malicious content, enforce outbound filtering for URLs containing the “sawye.cc” suffix, and ensure that email gateways block messages containing links to this domain. Because the domain is hosted behind Cloudflare, any future re‑hosting could inherit the same IP range, so reputation‑based controls that consider the AS number and certificate fingerprint are advisable. In the absence of further artifacts, the primary evidence for this threat consists of the registration date, hosting details, SSL certificate, vendor detections, and blocklist inclusion.