t-mobile[.]gibvjc[.]top

This domain, t-mobile.gibvjc.top, is actively engaged in credential phishing operations targeting T-Mobile customers. Analysis confirms the site is designed to harvest login credentials, payment details, or personal information under the guise of a legitimate telecommunications provider portal. The domain remains operational and has not been taken down as of the latest verification. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain is flagged by 12 of 95 security vendors on VirusTotal, indicating strong consensus on its malicious nature. It was registered through NameSilo, LLC, and resolves to the IP address 188.114.96.3, hosted on AS13335 Cloudflare, Inc. infrastructure. The domain was created on May 28, 2026, an anomalous future date suggesting potential registration system manipulation or misconfiguration. It appears on at least one security blocklist and is currently classified as high-risk due to its active phishing status. Notably, the domain lacks an SSL certificate, a critical security omission for any site handling sensitive user data. The current status of t-mobile.gibvjc.top remains active, posing an ongoing threat to unsuspecting users. Organizations and individuals are advised to block the domain at the DNS or network level immediately. Security teams should monitor for connections to the IP address 188.114.96.3 and investigate any internal systems that have interacted with this infrastructure. Users who may have visited the site should be instructed to reset credentials on legitimate T-Mobile portals and enable multi-factor authentication. Given the domain's use of Cloudflare hosting, additional scrutiny of similar domains leveraging the same IP range is recommended to identify potential related threats.