t-mobile[.]yvbaig[.]top

This domain, t-mobile.yvbaig.top, is identified as an active high-risk phishing site specifically designed to impersonate T-Mobile, a major telecommunications provider. The threat type is credential phishing, targeting users with fraudulent login portals to harvest account credentials, payment details, or personal information. As of the latest verification, the domain remains operational and continues to resolve to its hosting infrastructure. Infrastructure analysis reveals several critical indicators. The domain was registered on May 29, 2024, through NameSilo, LLC, a registrar frequently observed in malicious domain registrations. It resolves to the IP address 188.114.96.3, which is part of AS13335 operated by Cloudflare, Inc., a network commonly used to mask origin servers and evade detection. The site lacks an SSL certificate, increasing the risk of data interception during transmission. Detection metrics show that 19 of 95 security vendors on VirusTotal have flagged this domain as malicious. Additionally, the domain appears on one security blocklist and is actively blocked by PhishDestroy. The page title, 'Welcome to OpenResty!', suggests the use of a default or misconfigured web server, a common characteristic in hastily deployed phishing infrastructure. The current risk level is assessed as high due to the combination of active impersonation of a trusted brand, lack of encryption, and confirmed detection by multiple security entities. Users and organizations are strongly advised to block access to this domain at the network level. Security teams should monitor for connections to the IP address 188.114.96.3 and investigate any internal systems that may have interacted with it. End users should be educated to recognize phishing indicators, such as suspicious URLs, missing HTTPS indicators, and unsolicited requests for credentials. Continuous monitoring of newly registered domains under similar patterns is recommended to detect and mitigate related threats.