t-mobile[.]fgcdzu[.]top

T-mobile.fgcdzu.top is a phishing domain targeting T-Mobile users, designed to harvest sensitive information. The domain was first flagged on June 21, 2026, and has since been taken offline. It was registered with NameSilo, LLC and hosted on an IP managed by Cloudflare, Inc. Despite its offline status, the domain achieved a platform risk score of 73 out of 100, indicating a significant threat level during its active period.

The domain's page title, "Welcome to OpenResty!", suggests it may have been hastily set up or used a generic template to appear legitimate. With 21 out of 91 vendors on VirusTotal marking it as malicious, the domain was quickly identified as a threat. It also appeared on one public blocklist, specifically PhishDestroy's, which highlights its recognition as a security risk.

The domain's SSL certificate was issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its ease of access and cost-free nature. The phishing operation exploited the domain's brief active window to target users before comprehensive detection by antivirus vendors could occur. This case underscores the importance of rapid detection and response in the cybersecurity landscape, as malicious actors often capitalize on the delay between domain registration and its appearance in security databases.