t-mobile[.]esfjo[.]cc

The domain t-mobile.esfjo.cc was registered on February 21, 2026 through Gname.com Pte. Ltd. and is currently hosted on Cloudflare infrastructure (AS13335) with the public address 188.114.96.3, a US‑based IP. The authoritative nameservers are jasper.ns.cloudflare.com and malavika.ns.cloudflare.com. No TLS certificate is present, and an HTTP request returns a 522 timeout, reflected in the page title "esfjo.cc | 522: Connection timed out". The site is marked offline and has been taken down, but historical evidence indicates it was used as part of an Airdrop Scam kit that impersonates the T‑Mobile brand.

Security telemetry shows the domain appears on a single blocklist and was flagged by 13 of 93 vendors on VirusTotal, suggesting moderate detection confidence. Gridinsoft assigns a trust score of 0/100, reinforcing the malicious classification. The domain was blocked by the PhishDestroy sinkhole, confirming active mitigation. While the exact content of the fraudulent page has not been captured, the combination of brand impersonation, a known phishing kit, and multiple vendor detections provides sufficient evidence for classification as a brand‑impersonation threat.

Defenders should add t-mobile.esfjo.cc to URL filtering rules, block the associated IP 188.114.96.3, and monitor for any re‑registration attempts. Updating endpoint and network detection signatures to reference the observed nameservers and registrar may also reduce exposure to similar campaigns. Continuous observation of Cloudflare‑hosted assets linked to this ASN is recommended, as threat actors frequently recycle infrastructure for new impersonation attempts.