t-mobile[.]ybkfqh[.]top

PhishDestroy identifies t-mobile.ybkfqh.top as a confirmed credential theft site specifically designed to impersonate T-Mobile. This domain is currently offline, but its infrastructure and characteristics indicate a high risk for anyone who may have visited it while active. The site leveraged a deceptive domain structure to mimic legitimate T-Mobile login pages, aiming to harvest usernames, passwords, and potentially financial information from unsuspecting victims.

The domain was flagged by 12 of 95 VirusTotal vendors, a significant signal of malicious intent. It was registered through NameSilo, LLC, and created on May 28, 2026, which is notably a future date, suggesting possible data manipulation or an error. The domain resolves to IP address 188.114.96.3, which is associated with Cloudflare's infrastructure. It also appears on one security blocklist and lacks an SSL certificate, further indicating it was not intended for legitimate secure communications. The page title observed was "Welcome to OpenResty!," a common default page for the OpenResty web platform, which the attackers likely used as a placeholder or misdirection.

Given that t-mobile.ybkfqh.top has been taken offline, the immediate threat from this specific domain is neutralized. However, users who may have interacted with the site while active should change their T-Mobile account credentials immediately and monitor for any unauthorized activity. It is also advisable to enable multi-factor authentication on all accounts where available. PhishDestroy recommends staying vigilant against similar phishing attempts and reporting any suspicious domains to relevant security teams. Always verify the authenticity of URLs before entering sensitive information, especially those claiming to be from well-known brands like T-Mobile.