t-mobile[.]uvgnfg[.]top

This domain is flagged as a high-risk phishing site specifically designed to impersonate T-Mobile payment portals. Analysis indicates the threat type is brand impersonation, targeting users through fraudulent billing pages to harvest login credentials and financial details. The page title, t-mobile.uvgnfg.top/pay/, directly mimics legitimate T-Mobile payment gateways, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain was registered on June 04, 2026, through Gname.com Pte. Ltd. and resolved to IP address 8.211.195.254. VirusTotal detections show 19 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing categorizes it under SOCIAL_ENGINEERING. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100. Despite its current offline status, historical data confirms active phishing operations prior to takedown. Mitigation steps for this threat type include blocking the domain and its associated IP (8.211.195.254) at the network perimeter. Organizations should deploy email and web filtering rules to prevent delivery of messages containing this domain or related keywords (e.g., t-mobile.uvgnfg.top/pay/). End-users should be educated on identifying fraudulent payment portals, particularly those using unofficial subdomains or misspelled brand names. Security teams are advised to monitor for credential theft attempts originating from this infrastructure, as compromised accounts may be exploited for further attacks.