t-mobile[.]soyql[.]icu

This domain is flagged as a fake login portal designed to harvest credentials by impersonating T-Mobile authentication pages. Analysis indicates the threat type is brand impersonation phishing, targeting users through deceptive login prompts. The risk level is classified as elevated due to the domain's infrastructure and historical activity. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on December 07, 2025, and resolved to IP address 172.67.184.104, hosted on Cloudflare's network (AS13335). Security vendors on VirusTotal detected the domain at a rate of 18/95, with no SSL certificate present. The page title, 'Security Verification - Please Wait,' suggests an attempt to mimic legitimate security checks. The domain appears on one security blocklist and was previously blocked by PhishDestroy. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address across network security controls. Organizations should monitor for credential submission attempts to this domain in logs and reset any potentially compromised credentials. Users should be educated on recognizing brand impersonation tactics, such as verifying domain authenticity before entering login details. Network defenders are advised to check for residual DNS queries or connections to 172.67.184.104 and review proxy logs for interactions with the domain prior to its takedown.