t-mobile[.]fwdwdt[.]bond

The domain t-mobile.fwdwdt.bond was identified as a phishing site impersonating T-Mobile, aiming to harvest user credentials. With a VirusTotal detection score of 17 out of 95, it poses a significant risk to those who might encounter it. The domain's fraudulent nature was highlighted by its presence on two blocklists, indicating its malicious intent.

Registered through Gname.com Pte. Ltd., this domain was relatively new, aged 78 days, with an IP address of 188.114.96.3. This infrastructure choice often suggests a basic setup, making it easier for attackers to create and deploy phishing sites rapidly. The domain was flagged for suspicious activity consistent with phishing operations.

As of now, the domain has been taken down. PhishDestroy actively reported and monitored this threat, contributing to its removal from the active online landscape, thus preventing potential harm to users.