t-mobile[.]gjapof[.]top

This domain, t-mobile.gjapof.top, was registered on May 20, 2026 through NameSilo, LLC and is currently active. DNS resolution points to the address 104.21.67.99, which is served by Cloudflare as indicated by the authoritative name servers malcolm.ns.cloudflare.com and val.ns.cloudflare.com. The domain has been observed by multiple security vendors; VirusTotal records show that 16 of 91 scanners flagged the host, and the domain is listed on at least one external blocklist. PhishDestroy has also added the domain to its blocklist, confirming its use in credential‑harvesting operations targeting the T‑Mobile brand. The presence on a single security blocklist indicates early‑stage detection, but the multiple vendor flags demonstrate consensus on malicious intent.

The limited age of the registration—less than three months—combined with rapid detection suggests a short‑lived phishing campaign. No public page title or content analysis is available, so the exact login‑page structure, payload, or lure technique remains unknown. The lack of visible content prevents classification beyond generic phishing, but the targeting of the T‑Mobile brand aligns with recent credential‑harvesting campaigns observed against telecom providers. Infra‑level indicators, however, are sufficient for defensive action. Organizations should deny DNS resolution for t-mobile.gjapof.top at the resolver level, add the IP 104.21.67.99 to network‑level deny lists, and ensure that any outbound traffic to Cloudflare edge nodes matching this address is inspected.

Implement URL filtering in web proxies, enable strict TLS inspection for traffic to the IP, and consider sinkholing the domain to capture any future campaign traffic. Email gateways should be tuned to flag messages containing the domain or its sub‑domains, and security teams should monitor for similar domains registered through NameSilo that use Cloudflare name servers.