t-mobile[.]skvdtu[.]top

This domain, t-mobile.skvdtu.top, is an active credential theft operation impersonating T-Mobile's official infrastructure. Analysis indicates the site is designed to harvest login credentials, payment details, or personal information from unsuspecting users by presenting a fraudulent interface mimicking legitimate T-Mobile services. The use of a subdomain under skvdtu.top, combined with Cloudflare hosting, suggests an attempt to evade detection while maintaining a facade of legitimacy through the targeted brand impersonation. Technical evidence confirms the malicious nature of this domain. VirusTotal reports 16 out of 95 security vendors flagging the domain as malicious, with Google Safe Browsing specifically categorizing it as phishing. The domain was registered on May 7, 2026, through NameSilo, LLC, and currently resolves to the IP address 172.67.194.82, hosted on Cloudflare's network (AS13335). It appears on one security blocklist, and the SSL certificate is issued by Let's Encrypt, which, while common for legitimate sites, is frequently exploited by threat actors to create a false sense of security. The page title, 'Welcome to OpenResty!', further indicates the use of a reverse proxy or web server software, which is often employed to obscure the true nature of the backend infrastructure. Users who have visited t-mobile.skvdtu.top or entered credentials on the site should take immediate action to mitigate potential compromise. First, reset any passwords associated with T-Mobile accounts or other services where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor financial statements and account activity for signs of fraudulent transactions or unauthorized changes. If personal or payment information was entered, consider placing a fraud alert or credit freeze with relevant credit bureaus. Organizations should block the domain and its resolving IP address (172.67.194.82) at the network level to prevent further access by employees or customers. Report the domain to additional threat intelligence platforms to contribute to broader detection and takedown efforts.