t-mobile[.]gilqud[.]top

The domain t-mobile.gilqud.top has been identified as a brand impersonation threat targeting T-Mobile. Analysis indicates the domain was created to deceive users by mimicking the legitimate telecommunications provider, likely for credential harvesting or fraudulent transactions. The domain is currently offline, but prior activity suggests malicious intent under the guise of T-Mobile's branding. Infrastructure analysis reveals the domain was registered on May 15, 2026, through NameSilo, LLC, and resolved to the IP address 172.67.163.248, hosted by Cloudflare, Inc. in Canada. The domain appears on one security blocklist and is flagged by 17 of 95 security vendors on VirusTotal. The SSL certificate, issued by Let's Encrypt (serial number E8), further confirms its use of encrypted connections to appear legitimate. The page title, 'Welcome to OpenResty!', suggests the use of a web server framework often employed in malicious infrastructure. The domain has since been taken offline, likely due to detection by security mechanisms such as PhishDestroy. Organizations and users are advised to block the domain and its associated IP address (172.67.163.248) at the network level. Security teams should monitor for related domains registered through NameSilo or resolving to Cloudflare IPs, as these may indicate further impersonation attempts. Users should verify the authenticity of any communication claiming to be from T-Mobile by cross-referencing with official channels.