t-mobile[.]vgwumc[.]top

The domain t-mobile.vgwumc.top has been identified as posing a high-risk generic phishing threat. This domain's infrastructure was likely designed to deceive users into submitting personal information under false pretenses. The use of a recognizable brand in its subdomain suggests that attackers intended to exploit trust associated with that brand, potentially targeting customers of a well-known telecommunications company for malicious purposes.

Evidence supporting this threat assessment is substantial. VirusTotal reports that 11 out of 95 security vendors have flagged this domain as malicious. The domain was registered through NameSilo, LLC, and was created on May 28, 2026. Despite its recent creation, the domain has already been identified by Google Safe Browsing for 'SOCIAL_ENGINEERING' activities and appears on one security blocklist. It resolves to IP address 104.21.91.23 and utilized technologies such as Cloudflare and HTTP/3, indicating an attempt to maintain performance and security for deceptive purposes. Currently, the domain has been taken offline and is blocked by at least one security provider, PhishDestroy.

Users who visited this domain should take immediate steps to secure their personal information. It is recommended to change passwords for any accounts that may have been compromised, particularly those related to telecommunications services. Users should also monitor their financial accounts for any unauthorized transactions. Implementing two-factor authentication and ensuring that security software is up to date can further protect against similar threats. Reporting any suspicious activity to relevant authorities or security professionals can aid in tracking and mitigating phishing operations.