t-mobile[.]irvlkq[.]top

Analysis indicates that the domain t-mobile.irvlkq.top, created on May 20 2026 and registered through NameSilo, LLC, is actively being used for a generic phishing campaign. The domain resolves to the IP address 188.114.96.3 and is served by Cloudflare name servers kyree.ns.cloudflare.com and meilani.ns.cloudflare.com. Google Safe Browsing classifies the site as a social‑engineering threat, and the domain appears on one external security blocklist. Independent scanning on VirusTotal shows that 17 of 91 antivirus and URL‑reputation engines have flagged the domain as malicious, reinforcing the suspicion of phishing activity.

The blocklist PhishDestroy also lists the domain as blocked. The threat is rated high and the status is active, suggesting continued operation. Publicly available intelligence does not include a retrieved page title, SSL certificate details, HTTP response codes, or any observed brand‑specific lure, so the exact visual content and target of the phishing lure remain unknown. No Open Threat Exchange (OTX) entries or additional reputation scores were found in the current data set.

The short registration window of just over two months is consistent with the rapid deployment patterns often seen in phishing infrastructure. Given the confirmed infrastructure indicators—registrar, name servers, IP address, Safe Browsing flag, and multiple vendor detections—defenders should treat t-mobile.irvlkq.top as a high‑risk phishing source. Recommended actions include adding the domain to network and email deny lists, updating URL filtering policies, and monitoring for any future resolution changes or additional detection reports. Continuous re‑scanning with reputable sandbox services is advised to capture any payloads or credential‑harvesting pages that may appear if the site evolves.