t-mobile[.]chygl[.]cc

This domain, t-mobile.chygl.cc, was observed for a brand‑impersonation campaign targeting the T‑Mobile brand. The site was registered on 15 January 2026 through Gname.com Pte. Ltd. and uses the nameservers A.SHARE‑DNS.COM and B.SHARE‑DNS.NET. DNS resolution points to 172.67.132.168, an address owned by Cloudflare, Inc. (AS13335) located in the United States. No TLS certificate was presented, and an HTTP request returned the title “chygl.cc | 522: Connection timed out”, indicating that the service is currently unavailable.

The infrastructure is associated with an Airdrop Scam kit, a known vector for fraudulent token‑airdrop offers. Threat intelligence shows the domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis recorded 14 detections out of 93 scanning engines, reinforcing the malicious classification. Gridinsoft assigned a trust score of 0 / 100, reflecting extreme risk.

Because the site is offline, content‑level indicators such as login forms or branding are not available for verification. Defenders should immediately add t-mobile.chygl.cc to local deny lists, enforce DNS‑level blocking, and monitor the hosting IP for future activity that may reuse the same infrastructure. Continuous observation of the registrar Gname.com for new registrations resembling the current pattern is recommended, as is periodic re‑scanning of the domain should it become reachable again. The combination of a brand‑targeted kit, low trust score, multiple vendor detections, and blocklist presence warrants an elevated risk rating and proactive mitigation.