t-mobile[.]seplan[.]top

Analysis of the domain t-mobile.seplan.top indicates it is part of an active generic phishing campaign. The domain was registered through NameSilo, LLC on May 20 2026 and resolves to the IP address 172.67.201.80, which is hosted by Cloudflare as indicated by the authoritative name servers hans.ns.cloudflare.com and meera.ns.cloudflare.com. The infrastructure is listed on a single public blocklist and is actively blocked by the PhishDestroy service. VirusTotal has recorded detections from 18 of 91 scanning engines, confirming that a notable portion of security vendors consider the domain malicious.

The elevated risk rating reflects the combination of recent creation, cloud‑based hosting, and multiple vendor detections. Publicly available telemetry does not include a page title, SSL certificate details, or explicit brand impersonation beyond the domain label, so the exact content of the landing page remains unverified. Consequently, defenders cannot confirm which credential collection forms or user‑targeted messages are employed. The presence of Cloudflare name servers suggests the operators may be leveraging the provider’s CDN and DDoS mitigation to hide the true origin of the payload.

Given the observed indicators, security teams should add t-mobile.seplan.top to domain blocklists, enforce DNS‑level filtering, and monitor outbound connections to the associated IP address. Email gateways should be configured to flag messages containing URLs that resolve to 172.67.201.80, and endpoint detection solutions should treat any process that contacts this host as suspicious. Continuous re‑scanning on VirusTotal and other sandboxes is recommended to capture any evolving payloads. Organizations should also educate users about unsolicited requests for personal or account information, emphasizing that legitimate communications from the purported brand will never require credential entry through an unsolicited link.