t-mobile[.]lnruae[.]top

The domain t-mobile.lnruae.top was registered on May 18, 2026 through NameSilo, LLC and is currently hosted on the IP address 104.21.1.208. Its authoritative DNS is served by Cloudflare, using the nameservers cora.ns.cloudflare.com and matt.ns.cloudflare.com. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, indicating that at least one defensive organization has identified it as malicious.

VirusTotal analysis shows that 19 out of 91 security vendors flag the domain, reinforcing the suspicion of malicious intent. The risk level has been assessed as elevated and the infrastructure remains active as of the report date, July 29, 2026. Observable evidence is limited to registration details, hosting information, and the presence on blocklists and vendor detections; no page title, SSL certificate details, or content snapshots have been publicly released.

Consequently, the exact phishing campaign vector, targeted brand, or credential‑harvesting mechanism cannot be confirmed at this time. Defenders should add the domain to their deny lists, monitor DNS queries for the associated IP address, and ensure that any traffic to the domain is blocked at perimeter and endpoint layers. Continuous re‑evaluation is advised, as additional indicators such as page content, SSL metadata, or further vendor detections may emerge, providing clearer attribution and mitigation guidance.