t-mobile[.]yierm[.]cc

This domain, t-mobile.yierm.cc, is identified as a credential phishing infrastructure specifically designed to impersonate T-Mobile, a major telecommunications provider. Analysis indicates the site employs a generic phishing framework, likely leveraging cloned login portals to harvest user credentials, payment details, or personal identification information. The domain exhibits characteristics consistent with large-scale phishing campaigns, including the use of Cloudflare hosting to obfuscate origin servers and evade detection. No specific drainer kit signatures have been confirmed at this time, though the generic_phishing classification suggests a broad, adaptable attack vector rather than a specialized toolset. Technical indicators reveal multiple high-confidence red flags. The domain resolves to IP address 188.114.96.3, operated by AS13335 (Cloudflare, Inc.), a common hosting choice for phishing sites due to its CDN and proxy services. It was registered on February 21, 2026, an anomalous future date that strongly suggests domain spoofing or registry manipulation. VirusTotal detection metrics show 18 out of 95 security vendors flagging the domain as malicious, with PhishDestroy listing it on their blocklist. The SSL certificate is classified as WE1, a low-assurance certificate type frequently associated with fraudulent sites. No entries were found in Google Safe Browsing at the time of analysis, though this does not preclude prior or future listings. The domain is currently offline, likely following takedown actions or automated suspension by the hosting provider. Despite its inactive status, residual risk remains elevated due to the potential for domain reactivation or migration to alternative infrastructure. Organizations and users are advised to implement DNS-based blocking for t-mobile.yierm.cc and its resolving IP, monitor for credential reuse attempts, and deploy multi-factor authentication to mitigate account compromise risks. Security teams should correlate this domain with other T-Mobile-themed phishing campaigns to identify broader patterns or threat actor infrastructure.