t-mobile[.]gbvstk[.]shop

This domain, t-mobile.gbvstk.shop, is a credential theft operation designed to harvest T-Mobile account credentials. The site presents a fraudulent login interface mimicking the legitimate T-Mobile portal, tricking users into entering sensitive information such as usernames, passwords, and potentially two-factor authentication codes. Credential theft of this nature enables unauthorized account access, financial fraud, and identity theft, with attackers often exploiting stolen details for further malicious activities. Analysis indicates the domain is flagged by 19 out of 95 security vendors on VirusTotal, confirming its malicious classification. Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3, hosted on Cloudflare's network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common tactic to appear legitimate. The site is currently offline, but its presence on one security blocklist and its classification as phishing by Google Safe Browsing further validate its malicious intent. The page title, 'Welcome to OpenResty!', suggests the use of a default or misconfigured web server, a red flag for hastily deployed phishing infrastructure. If you visited t-mobile.gbvstk.shop or entered any credentials, immediate action is required. First, change the password for your T-Mobile account and any other accounts where the same credentials were reused. Enable multi-factor authentication if not already active. Monitor the account for unauthorized transactions or changes, and review connected devices for suspicious activity. Consider reporting the incident to T-Mobile's security team and relevant authorities, such as local cybercrime units or consumer protection agencies. Avoid interacting with the domain or any communications linked to it, as attackers may attempt follow-up phishing attempts via email or SMS.