t-mobile[.]uejot[.]cc

This domain, t-mobile.uejot.cc, is identified as a credential theft operation specifically targeting T-Mobile customers. Analysis indicates the site was designed to harvest user login credentials by mimicking the legitimate T-Mobile portal. As of the latest verification, the domain has been taken offline, though prior activity remains a confirmed threat to users who may have interacted with it during its active period. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolved to the IP address 172.67.198.16, hosted under AS13335 (Cloudflare, Inc.), a common tactic to obscure malicious infrastructure. The domain lacks an SSL certificate, increasing the risk of unencrypted data interception. Security vendors flagged the domain on VirusTotal, with 20 of 95 engines detecting it as malicious. Additionally, it appears on one security blocklist, further confirming its elevated risk profile. The page title, 'Welcome to nginx!', suggests default server misconfiguration or an attempt to evade detection by presenting benign content. The domain is currently offline, reducing immediate exposure risk. However, organizations and individuals should remain vigilant for residual threats, such as cached DNS entries or phishing emails redirecting to similar domains. Recommended actions include blocking the domain and its associated IP (172.67.198.16) at the network level, monitoring for credential reuse attempts, and educating users on identifying brand impersonation tactics. Security teams should also review logs for prior connections to t-mobile.uejot.cc or related infrastructure to assess potential compromise.