t-mobile[.]hzvngq[.]top

This domain, t-mobile.hzvngq.top, is confirmed as an active phishing site specifically designed to impersonate T-Mobile, a major telecommunications provider. The site is currently operational and presents a high-risk threat aimed at harvesting user credentials through fraudulent login portals. Analysis indicates the domain is structured to mimic legitimate T-Mobile authentication pages, increasing the likelihood of successful deception among unsuspecting users. Infrastructure analysis reveals the domain was registered on May 29, 2026, through NameSilo, LLC, a registrar frequently associated with malicious domains. It resolves to the IP address 188.114.96.3, which is hosted on Cloudflare’s network (AS13335). The domain lacks an SSL certificate, a common red flag for phishing sites. Security vendors have flagged this domain, with 15 out of 95 VirusTotal engines detecting it as malicious. Additionally, the domain appears on one security blocklist, and its page title, 'Welcome to OpenResty!', suggests the use of a default or misconfigured web server, further indicating its fraudulent nature. The current status of t-mobile.hzvngq.top remains active, posing an ongoing threat to users. Organizations and individuals are advised to block this domain at the network level and implement real-time monitoring for related indicators of compromise. Users should be educated on recognizing phishing attempts, particularly those impersonating trusted brands. Security teams are recommended to review logs for any connections to the IP address 188.114.96.3 and investigate potential credential theft or unauthorized access linked to this domain. Immediate reporting to relevant security communities is encouraged to mitigate further risk.