t-mobile[.]gojcze[.]top

This domain, t-mobile.gojcze.top, is designed to impersonate legitimate mobile carrier login portals through SMS phishing campaigns. Users receive text messages containing links to this domain, which presents a fraudulent login page to harvest account credentials, payment details, or personal information. The site mimics official branding to deceive targets into entering sensitive data, which is then transmitted to threat actors for financial fraud or identity theft purposes.

Analysis indicates this domain was registered on May 30, 2026, through NameSilo, LLC, an unusually future-dated creation that suggests domain spoofing or registry manipulation. VirusTotal detection shows 21 out of 95 security vendors flag the domain as malicious, with specific classifications including phishing and credential theft. The domain resolves to IP address 104.21.28.54, hosted on Cloudflare infrastructure (AS13335), and lacks SSL certification, increasing exposure to interception during data transmission.

If this domain was accessed, users should immediately terminate any active sessions and avoid entering credentials. Change passwords for any accounts entered on the site, particularly mobile carrier or financial accounts. Enable multi-factor authentication where available. Monitor accounts for unauthorized transactions or activity. Report the incident to relevant security teams and consider notifying financial institutions if payment details were submitted. The domain is currently offline, but similar phishing attempts may persist through other domains or communication channels.