t-mobile[.]vytpw[.]cc

The domain t-mobile.vytpw.cc is identified as a brand impersonation threat targeting T-Mobile customers. Analysis confirms this domain was actively used for phishing operations, currently marked as offline. The threat type is classified as credential harvesting through brand deception, a common tactic in telecommunications fraud campaigns. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. and resolved to IP address 188.114.96.3, hosted on Cloudflare infrastructure (AS13335). Detection metrics show 19 of 95 security vendors on VirusTotal flagged this domain as malicious. The domain was created on February 21, 2026, with no SSL certificate present. It appears on one security blocklist and displays the page title 'about:privatebrowsing,' a technique often used to mask malicious activity. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it during its active period. Organizations are advised to add this domain to web filtering blocklists and monitor for credential reuse attempts. Security teams should review logs for connections to 188.114.96.3 and investigate any authentication attempts linked to this domain. End users should be alerted to verify domain authenticity before entering credentials on any T-Mobile-related sites.