t-mobile[.]iyklmv[.]sbs

The domain t-mobile.iyklmv.sbs is identified as a credential theft site impersonating T-Mobile and is currently offline. This domain poses a high risk to users who may inadvertently provide sensitive information such as usernames and passwords.

Analysis indicates that the domain t-mobile.iyklmv.sbs was flagged by 13 of 95 security vendors on VirusTotal, indicating a significant level of suspicious activity. The domain was registered through NameSilo, LLC and resolved to the IP address 188.114.97.3. It was created on June 09, 2026, and appears on 1 security blocklist. Google Safe Browsing has also flagged this domain for SOCIAL_ENGINEERING, which aligns with the credential theft threat type. The domain was taken offline as part of a coordinated effort to mitigate phishing risks.

The domain t-mobile.iyklmv.sbs is currently offline, but the infrastructure and techniques used suggest that it could be reactivated. Organizations and individuals are advised to remain vigilant and avoid any links or communications that lead to this domain. Network administrators should ensure that firewalls and DNS filters are updated to block this domain, and users should be educated on the signs of phishing attacks, including unexpected emails or messages with urgent requests for personal information. Regular monitoring of security advisories and blocklists is recommended to stay informed about emerging threats.