t-mobile[.]qvubyk[.]top

The domain t-mobile.qvubyk.top is identified as a high-risk fake login phishing domain, currently active and impersonating T-Mobile. This domain is designed to deceive users into providing their login credentials, potentially leading to account compromise and data theft.

Analysis indicates that t-mobile.qvubyk.top has been flagged by 21 out of 95 VirusTotal vendors, suggesting a significant level of suspicion. The domain is registered through NameSilo, LLC, and is using a Let's Encrypt SSL certificate (E7). It resolves to the IP address 104.21.54.158, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The domain was created on May 27, 2026, and appears on one known security blocklist. Additionally, it is blocked by PhishDestroy. Infrastructure analysis reveals that the domain is hosted on a reputable CDN, which could be indicative of an attempt to evade detection and increase user trust.

The domain t-mobile.qvubyk.top remains active as of the latest assessment. Given the high risk level and the potential for significant harm, it is recommended that security teams block this domain at the network level and educate users about the dangers of fake login pages. Users should be advised to always verify the URL and SSL certificate of any T-Mobile login page they visit, and to report any suspicious activity to the IT security department. Regular monitoring and updates to blocklists are advised to ensure ongoing protection against this and similar threats.