t-mobile[.]zbkay[.]cc

This domain, t-mobile.zbkay.cc, is actively flagged as a high-risk phishing site targeting the T-Mobile brand. Analysis indicates the subdomain was registered under zbkay.cc on February 21, 2026, and remains operational as of July 12, 2026. The domain resolves to IP address 188.114.96.3, hosted on Cloudflare’s infrastructure (AS13335), which is commonly used to obscure malicious activity behind legitimate content delivery networks. Security vendors have detected this domain, with 16 out of 95 engines on VirusTotal identifying it as malicious, while it also appears on one security blocklist. Infrastructure review reveals the domain employs Cloudflare nameservers (autumn.ns.cloudflare.com and yadiel.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The HTTP status code returned is 200, though the page title displays a Cloudflare 522 timeout error, suggesting either intermittent availability or deliberate evasion of automated analysis. The use of HTTP/3 further aligns with modern phishing tactics to improve performance and bypass legacy security controls. While the exact content of the phishing page remains unconfirmed due to the timeout error, the subdomain structure (t-mobile.zbkay.cc) strongly implies an attempt to impersonate T-Mobile for credential harvesting or fraudulent transactions. Defenders should treat this domain as active and high-risk, blocking resolution at the DNS level and monitoring for connections to 188.114.96.3. Given the domain’s recent creation and Cloudflare-backed infrastructure, additional subdomains or IP rotations may emerge, warranting continuous monitoring of related indicators.