t-mobile[.]phykbg[.]top

This domain is flagged as a high-risk credential harvesting phishing site targeting users of a major telecommunications provider. Analysis indicates the infrastructure is designed to mimic legitimate login portals, capturing sensitive authentication details such as usernames, passwords, and potentially multi-factor authentication codes. The threat type is classified as generic_phishing with a focus on account compromise, enabling subsequent unauthorized access to personal and financial data. Infrastructure analysis reveals the domain t-mobile.phykbg.top resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain was registered on May 30, 2026, through NameSilo, LLC, an unusual creation date suggesting potential domain spoofing or backdating. Security vendor detections on VirusTotal report 20 out of 95 engines flagging the domain as malicious. The site appears on one security blocklist and is actively blocked by PhishDestroy. The page title, 'Welcome to OpenResty!', indicates the use of a web server framework commonly employed in phishing kits, while the absence of an SSL certificate further reduces user trust signals. Mitigation steps for this threat include immediate blacklisting of the domain and its associated IP (188.114.96.3) at the network perimeter. Organizations should deploy email filtering rules to quarantine messages containing links to t-mobile.phykbg.top or similar subdomains. End-users should be educated on recognizing phishing indicators, such as unusual domain structures, missing SSL certificates, and generic web server banners. Security teams are advised to monitor for credential reuse attempts stemming from compromised accounts and implement multi-factor authentication to reduce the impact of successful phishing attempts. Regular threat intelligence updates should be applied to ensure detection of evolving phishing infrastructure.