t-mobile[.]fvikw[.]top

PhishDestroy identifies t-mobile.fvikw.top as a high-risk domain engaged in brand impersonation, specifically targeting T-Mobile customers. This threat involves mimicking the official T-Mobile login or support portal to steal credentials, a classic credential theft scheme. The site was registered through NameSilo, LLC and resolves to IP address 172.67.128.90, which is associated with Cloudflare's infrastructure, often abused by phishers for its anonymity and CDN capabilities. The domain was created on May 29, 2026, and its page title displayed "Welcome to OpenResty!"—a default nginx-based server page—indicating the site was likely under construction or used as a landing page for malicious redirects.

VirusTotal analysis shows 20 out of 95 security vendors flagging this domain as malicious, a strong indicator of widespread detection. Google Safe Browsing explicitly flags it for phishing. The domain appears on one security blocklist and currently has no SSL certificate, meaning any data transmitted would be unencrypted. The domain is now offline, but its infrastructure remains a risk for future campaigns. The combination of a newly registered domain, lack of encryption, and high vendor detection rate confirms this was an active threat.

Users who may have visited t-mobile.fvikw.top should immediately change their T-Mobile account passwords and enable two-factor authentication if not already active. Since this is a brand impersonation site targeting credential theft, monitor for any unauthorized access or suspicious activity on T-Mobile accounts and linked financial services. Avoid clicking links in unsolicited messages claiming to be from T-Mobile, and always verify URLs by typing the official domain directly into the browser. Report any similar domains to T-Mobile's security team and to phishing reporting services like the Anti-Phishing Working Group.