t-mobile[.]vnjbr[.]cc

The domain t-mobile.vnjbr.cc was registered on February 21, 2026 and is currently taken offline. Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which belongs to AS13335 operated by Cloudflare, Inc. and is geolocated to the United States. The SSL certificate presented for the host is identified as "WE1", but no further certificate details (such as issuer or validity period) are available in the supplied intelligence. Reputation scoring from Gridinsoft assigns the domain a zero‑out‑of‑one‑hundred trust score, indicating an extremely poor reputation.

VirusTotal has recorded nine positive detections out of ninety‑three scanning engines, confirming that multiple security vendors flag the host as malicious. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole, further corroborating its classification as a phishing infrastructure. No page title, brand target, or kit information is provided, so the exact content served by the site remains unknown; however, the domain name itself suggests an attempt to impersonate the T‑Mobile brand.

Defenders should continue to block the domain at perimeter controls, monitor DNS queries for the host name, and add the IP address 188.114.97.3 to reputation‑based deny lists. Because the host is hosted behind Cloudflare, any future re‑hosting attempts may leverage the same CDN, so threat‑intel feeds should be updated with the domain and associated IP for rapid detection. Ongoing observation of the IP for additional malicious payloads or new sub‑domains is advised, and security teams should ensure endpoint and email security solutions incorporate the latest indicator sets from the nine vendor detections and the Gridinsoft score.