t-mobile[.]btfhks[.]top

Analysis indicates that the domain t-mobile.btfhks.top was registered on 2026-06-01 through NameSilo, LLC and is currently using Cloudflare name servers burt.ns.cloudflare.com and michelle.ns.cloudflare.com. The domain resolves to the IPv4 address 188.114.96.3 and remains active as of the 2026-07-13 assessment. The operational profile matches a recently created infrastructure commonly observed in generic phishing campaigns, and the threat classification has been set to generic_phishing with a risk level of under_investigation. No public content, page title, or additional payload information has been disclosed, leaving the exact lure and credential‑harvesting mechanisms unknown. The short lifespan, use of reputable DNS provider, and immediate activation suggest an intent to exploit the freshness of the domain before detection. Defenders should consider adding the domain to block lists, enforce DNS filtering for outbound queries to the IP, and monitor for any authentication attempts that reference the domain. Ongoing observation is recommended to capture any future host or payload changes that could clarify the phishing vector.