t-mobile[.]esvpir[.]top

T-mobile.esvpir.top, a domain imitating T-Mobile, has been flagged by 14 out of 91 vendors on VirusTotal, indicating a significant threat level. Despite the domain currently being offline, it was actively targeting users with phishing schemes. The domain's presence on public blocklists, including PhishDestroy, and its Google Safe Browsing flag further emphasize its malicious intent.

Registered with NameSilo, LLC and hosted on an IP associated with Cloudflare, Inc., the domain was created on May 28, 2026, and detected by PhishDestroy just two days later. The quick detection highlights the efficiency of PhishDestroy's threat intelligence pipeline, which captures threats in their early stages before widespread anti-virus database updates can occur.

The domain's page title, "Welcome to OpenResty!", suggests it may have been a hastily set up phishing site, possibly indicating an attempt to exploit users quickly before being taken down. With a platform risk score of 88 out of 100, the domain posed a high risk to potential victims, particularly those who might have been deceived by the T-Mobile branding.

While the site is currently offline, its initial activity serves as a reminder of the persistent threat phishing domains represent. The rapid detection and subsequent flagging by multiple security vendors underscore the importance of proactive threat monitoring and swift action to mitigate risks posed by such malicious entities.