t-mobile[.]kwahbv[.]top

t-mobile.kwahbv.top was registered on May 20, 2026 through NameSilo, LLC. The domain resolves to the IPv4 address 188.114.97.3 and is served by Cloudflare nameservers malcolm.ns.cloudflare.com and val.ns.cloudflare.com. VirusTotal has received 91 submissions for this domain, of which 18 security vendors have raised a detection, indicating a moderate level of consensus that the site is malicious. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy filtering service.

No additional public intelligence such as Safe Browsing entries, Open Threat Exchange reports, or SSL certificate details are currently available for this host. The limited detection footprint suggests that the campaign is relatively recent, consistent with the registration date less than three months before the report date. The use of Cloudflare DNS may provide resilience against takedown attempts, while the single blocklist presence indicates that broader community awareness is still developing.

Defenders should add the domain and its resolved IP address to local deny lists, monitor DNS queries for the associated Cloudflare nameservers, and consider ingesting the blocklist entry from PhishDestroy into existing threat feeds. Continuous re‑evaluation is advised, as additional detections or blocklist listings may appear as the campaign matures.