t-mobile[.]pvkezn[.]top

This domain, t-mobile.pvkezn.top, is identified as a phishing site impersonating T-Mobile, a telecommunications provider. Analysis indicates the site was designed to deceive users into entering credentials or personal information under the pretense of legitimate T-Mobile services. No cryptocurrency drainer or payment interception scripts were explicitly detected, but the domain structure and page title suggest a credential harvesting objective. The site employed generic server responses, including a default 'Welcome to OpenResty!' page title, which may indicate incomplete deployment or evasion tactics. Infrastructure analysis reveals the domain was registered on May 19, 2026, through NameSilo, LLC, a registrar frequently associated with abusive registrations. The domain resolves to the IP address 188.114.96.3, part of a network known for hosting transient phishing infrastructure. Detection metrics show 17 out of 95 security vendors flagged the domain as malicious on VirusTotal, while only one security blocklist currently includes it. The domain exhibits a Gridinsoft trust score of 0 out of 100, reinforcing its classification as high-risk. Technologies detected include Cloudflare and Cloudflare Browser Insights, suggesting the use of content delivery and performance monitoring tools to enhance site legitimacy and evade detection. As of the latest assessment, t-mobile.pvkezn.top has been taken offline, likely due to takedown actions or infrastructure abandonment. The domain is blocked by PhishDestroy and other security mechanisms, reducing immediate exposure risk. However, residual risk remains due to potential re-registration or migration to alternative domains. Organizations are advised to monitor for similar impersonation attempts, particularly those using newly registered domains with Cloudflare-hosted infrastructure. End users should verify domain authenticity before entering credentials and report suspicious sites to relevant security teams for further investigation.