t-mobile[.]mkvjlt[.]top

This domain, t-mobile.mkvjlt.top, is actively engaged in credential theft targeting T-Mobile customers. Analysis indicates the infrastructure is designed to mimic legitimate T-Mobile login portals, tricking users into submitting account credentials, personal details, or payment information. The domain employs social engineering tactics, including urgent account verification prompts and spoofed email campaigns, to exploit trust in the T-Mobile brand. Visitors are likely to encounter realistic-looking forms that harvest sensitive data for unauthorized access or financial fraud. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on May 28, 2026, through NameSilo, LLC, with an anomalous future creation date suggesting potential registration abuse or typo-squatting. It resolves to IP address 104.21.25.89, hosted on AS13335 Cloudflare, Inc., a network frequently leveraged to obfuscate malicious activity. The domain appears on one security blocklist and is flagged by 11 out of 95 security vendors on VirusTotal, confirming its malicious classification. Notably, the site lacks an SSL certificate, increasing the risk of data interception during transmission. Users who have visited t-mobile.mkvjlt.top should take immediate corrective action. First, reset passwords for any accounts accessed via the domain, prioritizing T-Mobile credentials and linked financial services. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized transactions or login attempts, and report anomalies to the legitimate service provider. If personal or financial information was submitted, consider placing a fraud alert on credit reports and reviewing recent transactions for signs of misuse. Avoid interacting with any communications originating from this domain, as they may contain further malicious payloads or phishing attempts.