t-mobile[.]wqnptf[.]top

T-mobile.wqnptf.top is a phishing domain that impersonates T-Mobile. It has been flagged by 19 out of 91 vendors on VirusTotal, indicating significant malicious activity. The domain is also listed on two public blocklists, including PhishDestroy and OpenPhish, and has been flagged by Google Safe Browsing. The site is currently offline, reducing its immediate threat, but its previous activity highlights the ongoing risk of similar phishing schemes.

The domain was registered through NameSilo, LLC, and hosted on an IP address associated with Cloudflare, Inc. in the United States. The SSL certificate was issued by Let's Encrypt, a common choice for phishing sites due to its ease of access and free nature. Despite its current offline status, the domain's initial detection by PhishDestroy on June 20, 2026, underscores the importance of early identification in mitigating phishing threats.

PhishDestroy's proactive detection pipeline captured this domain during its active phase, before it could propagate widely across antivirus databases. This early detection is crucial, as phishing domains often exploit the time gap between registration and AV database updates. The platform risk score of 83/100 further emphasizes the potential danger posed by such domains. While t-mobile.wqnptf.top is no longer active, the incident serves as a reminder of the persistent threat posed by phishing domains and the need for continuous monitoring and rapid response.