t-mobile[.]tbjacd[.]top

The domain t-mobile.tbjacd.top was registered on May 20, 2026 through NameSilo,LLC and is served by Cloudflare nameservers malcolm.ns.cloudflare.com and val.ns.cloudflare.com. DNS resolution points to the address 172.67.209.140, a Cloudflare‑owned IP range commonly used for content delivery and proxying. VirusTotal records indicate that 18 of 91 scanned security vendors flag the domain as malicious, evidencing a consensus among multiple scanners that the site hosts malicious activity.

The domain is presently listed on a single external security blocklist and has been actively blocked by the PhishDestroy filtering service, confirming that at least one commercial anti‑phishing solution has taken remediation action. The combination of a recent registration, use of reputable hosting infrastructure, and a moderate detection rate suggests a short‑lived, opportunistic campaign rather than an entrenched infrastructure. Defenders should add the IP address 172.67.209.140 to network‑level deny lists where feasible, monitor outbound connections to that address, and enforce URL filtering policies that include t-mobile.tbjacd.top.

Because the domain currently resolves through Cloudflare, typical domain‑based blocking may be bypassed by sub‑domain changes; therefore, applying DNS‑sinkholing or DNS‑based allow‑list overrides for the authoritative nameservers is advisable. Continuous re‑evaluation is recommended, as detection counts may rise if additional security vendors submit new samples, and the single blocklist entry may expand to broader threat‑intel feeds. Organizations should also educate users to remain cautious of unsolicited communications referencing T‑Mobile services, even though the specific brand impersonation cannot be confirmed from the available metadata.