verify-mobile-esl-org.cfd
Appeared in the .cfd zone on Tuesday, September 8, 2026; by the end of that day the census found boilerplate page. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
Name is a classic credential-phish hostname pattern ('verify-mobile-' + brand + '-org') on a cheap .cfd TLD, most plausibly targeting esl.org (ESL Federal Credit Union), but the live page is only the default CyberPanel hosting control-panel login — staging infrastructure with no deceptive content deployed yet, so the phish is not yet evidenced.
Domain name 'verify-mobile-esl-org.cfd' impersonates T-Mobile through 'mobile' typosquat and 'verify' lure word, but the page displays a CyberPanel login form with CyberPanel branding. This is a sealed-room phish: the password form posts to itself with no legitimate offsite links, designed to harvest credentials. The domain-name impersonation of T-Mobile combined with a functional credential-capture form indicates an active phishing setup, likely targeting T-Mobile customers or employees.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Tuesday, September 8, 2026
Same data as JSON: /api/zone/domain/verify-mobile-esl-org.cfd. This page is not indexed by search engines and does not link to the site it describes.