t-mobile[.]zmgse[.]cc

The domain t-mobile.zmgse.cc was registered on February 21, 2026 and is currently flagged as offline. DNS resolution maps the name to the IP address 172.67.212.19, which belongs to AS13335 operated by Cloudflare, Inc., locating the host in the United States. The site presents an SSL certificate labeled WE1, indicating that TLS is active despite the domain’s inactive status. Threat‑intelligence sources have placed the domain on a single security blocklist, and it is explicitly blocked by the PhishDestroy service.

VirusTotal analysis shows that 14 out of 93 scanned security vendors have generated detections for the domain, confirming that multiple independent tools recognize it as malicious. No additional context such as page title, brand target, or specific phishing kit is available in the current intelligence, leaving the precise content of the site unverified. The combination of recent registration, Cloudflare hosting, active TLS, blocklist inclusion, and multi‑vendor detections suggests a purpose‑built phishing infrastructure, likely intended to exploit the recognizable “t‑mobile” sub‑domain to lure victims.

Defenders should continue to enforce blocklist rules for this domain, monitor any future DNS changes, and consider extending detection coverage to similar sub‑domain patterns. Network sensors and endpoint protection platforms should treat any traffic to t-mobile.zmgse.cc as suspicious and quarantine related connections. Continuous re‑evaluation is advised in case the domain is re‑activated or additional indicators emerge.