t-mobile[.]ncdiym[.]top

The domain t-mobile.ncdiym.top was registered through NameSilo, LLC and first appeared on May 20, 2026. Its authoritative name servers are hans.ns.cloudflare.com and meera.ns.cloudflare.com, and DNS resolution points to the IP address 172.67.207.6, which is hosted on Cloudflare’s network. The domain is listed on a single security blocklist and has been flagged by the PhishDestroy feed, indicating that at least one reputable anti‑phishing service has taken active mitigation steps against it.

VirusTotal analysis shows that 18 of 91 scanned security vendors label the domain as malicious, providing independent corroboration of its hostile intent. No additional public reputation signals such as Google Safe Browsing, Open Threat Exchange entries, SSL certificate details, HTTP response codes, or trust‑score metrics are currently available for this host, and the page title or content has not been publicly disclosed. The available evidence therefore confirms the domain’s use in a generic phishing campaign, likely aimed at harvesting credentials associated with the T‑Mobile brand.

Uncertainty remains around the full scope of the phishing infrastructure, the specific payload delivered to victims, and any additional hosting or command‑and‑control endpoints that may be linked to the same IP address. Defenders should block DNS resolution for t-mobile.ncdiym.top at the network perimeter, add the domain to local and cloud‑based URL filtering lists, and monitor outbound traffic to 172.67.207.6 for anomalous patterns. Continuous re‑evaluation of VirusTotal and other multi‑engine scanners is advised, as additional detections may emerge as the campaign evolves.