t-mobile[.]vusocd[.]top

On July 23, 2026, the domain t-mobile.vusocd.top was observed to be taken offline. The domain was registered on May 10, 2026 through NameSilo, LLC and resolves to the Cloudflare‑owned IP address 188.114.97.3, which is geolocated to Canada. The authoritative nameservers are bristol.ns.cloudflare.com and frank.ns.cloudflare.com, indicating that the infrastructure is fully hosted behind Cloudflare’s edge network, with support for HTTP/3 and Cloudflare Browser Insights. The TLS certificate presented is issued by Let’s Encrypt (CN=E8), a free certificate authority commonly used by malicious actors to obtain short‑lived HTTPS coverage. The site’s HTML title reports “Welcome to OpenResty!” and no further content has been captured, so the visual or functional aspects of the page remain unknown.

Threat intelligence tags the domain as a credential‑phishing operation impersonating the T‑Mobile brand. The domain appears on a single public blocklist and is flagged by PhishDestroy, confirming that at least one anti‑phishing service has taken it down. VirusTotal analysis shows that 20 out of 95 scanning engines have classified the domain as malicious, reinforcing the phishing designation. Gridinsoft assigns a trust score of 0/100, indicating an extremely low reputation. Uncertainties include the exact phishing page layout, the presence of any credential‑harvesting forms, and whether additional payloads were hosted before the takedown.

No evidence of other malware kits, command‑and‑control channels, or secondary hosting was observed. Defenders should continue to block the domain at DNS and proxy layers, monitor for any sub‑domains that may be created under the same registrar, and add the IP address 188.114.97.3 to threat‑intel feeds.