t-mobile[.]hfylvt[.]top

This domain, t-mobile.hfylvt.top, is actively impersonating T-Mobile’s official authentication portal to harvest user credentials. Analysis indicates the site presents a fraudulent login interface designed to mimic legitimate T-Mobile account access pages, likely targeting mobile subscribers with urgent or deceptive prompts. The infrastructure is configured to capture entered usernames, passwords, and potentially multi-factor authentication codes, which could enable unauthorized account access or identity fraud. Evidence confirms the domain’s malicious intent through multiple technical indicators. VirusTotal reports 12 out of 95 security vendors flagging the domain as phishing, while it appears on at least one security blocklist. The domain was registered on May 28, 2026, through NameSilo, LLC, an unusual future date suggesting possible domain spoofing or registry manipulation. It resolves to IP address 172.67.132.205, hosted on Cloudflare’s network (AS13335), and lacks any SSL certificate, increasing the risk of data interception during transmission. Users who visited t-mobile.hfylvt.top should immediately cease all interaction and assume credentials entered were compromised. Reset passwords for any accounts accessed through the site, particularly T-Mobile or linked financial services. Enable multi-factor authentication where available and monitor accounts for unauthorized activity. Network administrators should block the domain and its resolving IP at the perimeter, while security teams should inspect logs for connections to 172.67.132.205 or related subdomains under hfylvt.top.