t-mobile[.]xfytvn[.]top

This domain, t-mobile.xfytvn.top, is flagged as a high-risk phishing site designed to impersonate T-Mobile. Analysis indicates the threat type is a fake login portal, likely targeting users to harvest credentials or personal information. The domain exhibits no evidence of cryptocurrency drainer infrastructure but instead focuses on brand impersonation to deceive victims into entering sensitive data. The page title, 'Welcome to OpenResty!', suggests the use of a misconfigured or intentionally obscured web server, a common tactic in phishing campaigns to avoid immediate detection. Technical indicators confirm the domain's malicious intent. It resolves to the IP address 188.114.96.3, hosted behind CloudFlare infrastructure in Canada, which may obscure the true origin of the attack. The domain was registered on May 18, 2026, through NameSilo, LLC, a registrar frequently abused for phishing operations. Google Safe Browsing explicitly flags this domain as phishing, and it appears on one security blocklist. VirusTotal reports 8 out of 95 security vendors detecting the domain as malicious, with detections likely based on behavioral analysis, domain reputation, or heuristic indicators. The absence of an SSL certificate further reduces the site's legitimacy, as modern phishing campaigns typically employ SSL to appear credible. As of the latest assessment, t-mobile.xfytvn.top remains active, posing an ongoing risk to users. The domain is blocked by at least one security provider, but the lack of broader blocklist adoption suggests it may still evade detection in some environments. Organizations and individuals are advised to update web filters, endpoint protection rules, and email security policies to explicitly block this domain. Users who may have interacted with the site should immediately reset credentials for T-Mobile accounts or any other services where the same credentials were reused. Monitoring for unauthorized access or account changes is recommended, particularly for accounts linked to the impersonated brand.