t-mobile[.]cvpjwk[.]top

This domain, t-mobile.cvpjwk.top, is identified as a T-Mobile brand impersonation campaign designed for credential theft. Analysis confirms the domain is currently offline, though it previously hosted infrastructure mimicking legitimate T-Mobile authentication portals to harvest user login credentials. The campaign leveraged social engineering tactics, including urgency and official branding, to deceive targets into submitting sensitive account details. Infrastructure analysis reveals the domain was registered through NameSilo, LLC on May 30, 2026, and resolved to the IP address 188.114.96.3, associated with AS13335 (Cloudflare, Inc.). Detection metrics indicate the domain was flagged by 19 of 95 security vendors on VirusTotal, with one active blocklist entry (PhishDestroy). The page title, 'Welcome to OpenResty!', suggests the use of a reverse proxy or web server framework, while the absence of an SSL certificate further undermines the appearance of legitimacy. The domain’s creation date, set in the future, may indicate an attempt to evade initial scrutiny or align with a planned attack timeline. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with the site prior to its deactivation. Organizations and individuals are advised to monitor for unauthorized access to T-Mobile accounts, particularly those linked to corporate or high-value services. Network administrators should block the IP address 188.114.96.3 and domain t-mobile.cvpjwk.top at the perimeter, while end-users should verify the authenticity of any T-Mobile-branded communications through official channels. Continuous vigilance is recommended, as threat actors frequently repurpose infrastructure for subsequent campaigns.