t-mobile[.]aqdfr[.]top

The domain t-mobile.aqdfr.top is currently flagged as an active phishing site specifically designed to impersonate T-Mobile. Analysis indicates this infrastructure is being used for credential harvesting and fraudulent account access attempts, targeting mobile service subscribers. The domain remains operational and poses a high risk to unsuspecting users. Infrastructure analysis reveals critical indicators of compromise. The domain was registered through NameSilo, LLC on May 29, 2026, an unusually future-dated creation that suggests fraudulent registration practices. It resolves to IP address 172.67.181.137, hosted on Cloudflare's network (AS13335), and lacks any SSL certificate, exposing user interactions to interception. Security vendors have flagged this domain, with 11 out of 95 engines on VirusTotal detecting malicious activity. The domain appears on one security blocklist and is actively blocked by enterprise phishing protection systems. Google Safe Browsing has also classified this as a phishing threat, further validating its malicious nature. Current status confirms the domain remains active and continues to host phishing content, presenting an ongoing threat to T-Mobile customers. Organizations and individuals are advised to implement immediate network-level blocking of this domain and its associated IP address. Security teams should monitor for connections to 172.67.181.137 and investigate any internal systems that have interacted with this infrastructure. Users who may have visited this site should be instructed to reset their credentials through official T-Mobile channels and enable multi-factor authentication. Proactive monitoring for similar domains using the 't-mobile' brand in subdomains is recommended to prevent future compromise.