t-mobile[.]uolpmb[.]top

On July 29, 2026, the domain t-mobile.uolpmb.top was identified as an active phishing infrastructure with an elevated risk rating. The domain was registered through NameSilo, LLC on May 20, 2026 and is hosted on the IP address 172.67.136.38, which is associated with Cloudflare’s network. Resolution queries return the authoritative nameservers hans.ns.cloudflare.com and meera.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The domain appears on one security blocklist and is actively blocked by the PhishDestroy platform.

VirusTotal analysis shows that 18 of 91 scanned security vendors flag the domain as malicious, indicating a moderate consensus among antivirus and URL‑reputation engines. No additional public indicators such as page title, SSL certificate details, or observed phishing kit have been disclosed, leaving the exact content and lure mechanisms undocumented. The lack of detailed payload information creates uncertainty about the specific brand impersonation or credential‑stealing tactics employed. Defenders should prioritize immediate blocking of t-mobile.uolpmb.top at perimeter firewalls, DNS resolvers, and proxy filters.

Continuous monitoring of DNS queries for the associated IP address and Cloudflare nameservers is advised, as the infrastructure may be leveraged for further malicious domains. Organizations using threat‑intelligence feeds should ensure the domain is added to blocklists and that alerts are generated for any traffic attempts to the domain. Ongoing re‑evaluation is recommended as additional telemetry becomes available.