t-mobile[.]dlecjq[.]top

The domain t-mobile.dlecjq.top was registered on May 18, 2026 through NameSilo,LLC and is currently hosted on the IP address 172.67.128.195, which is served by Cloudflare nameservers cora.ns.cloudflare.com and matt.ns.cloudflare.com. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, indicating that at least one trusted anti‑phishing feed has identified it as malicious. VirusTotal analysis shows that 16 of 91 security vendors flag the domain, providing additional corroboration of its hostile nature.

The threat classification supplied is generic phishing, and the risk level is elevated, suggesting that the domain is actively used in credential‑stealing campaigns. No public evidence of SSL certificate details, HTTP status codes, page title, or content has been disclosed in the available intelligence, so the precise look‑and‑feel of the landing page remains unknown. Infrastructure analysis confirms that the domain resolves to a Cloudflare‑protected address, a pattern frequently leveraged by threat actors to hide origin infrastructure and benefit from CDN resilience.

Defenders should add the domain to internal blocklists, monitor DNS queries for lookups to t-mobile.dlecjq.top, and enforce outbound filtering that blocks connections to the associated IP address. Email security gateways should be updated to flag any messages containing links to this domain, and user awareness training should emphasize that unsolicited communications referencing T‑Mobile may be fraudulent. Continuous re‑evaluation is advised, as additional detections or changes in hosting configuration could alter the threat posture.