t-mobile[.]rzmfhv[.]top

This domain is flagged as a high-risk generic phishing threat targeting T-Mobile customers. Analysis indicates the infrastructure is designed to mimic legitimate login portals, likely harvesting user credentials through fraudulent authentication forms. The domain exhibits characteristics consistent with credential theft campaigns, including the use of a deceptive subdomain structure and Cloudflare-hosted infrastructure to evade detection. Infrastructure analysis reveals the domain t-mobile.rzmfhv.top was registered on May 15, 2026, through NameSilo, LLC, and currently resolves to IP address 172.67.219.79, geolocated to a Cloudflare node in Canada. The domain appears on one security blocklist and is flagged by 7 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt (serial number E7), and the page title displays 'Welcome to OpenResty!', suggesting the use of a reverse proxy or misconfigured server typically associated with malicious hosting environments. Mitigation requires immediate blocking of the domain and its resolving IP address (172.67.219.79) at network perimeter controls. Security teams should monitor for connections to this infrastructure, particularly from endpoints exhibiting signs of credential compromise. End-user education should emphasize verifying domain authenticity before entering credentials, focusing on the exact URL structure and SSL certificate details. Organizations should implement multi-factor authentication to mitigate the impact of potential credential theft from this campaign.