t-mobile[.]dtvbsu[.]top

The domain t-mobile.dtvbsu.top, a phishing site targeting T-Mobile customers, has been flagged by 17 out of 91 vendors on VirusTotal. Despite its offline status, the domain's history of malicious activity underscores its threat potential. Hosted on Cloudflare infrastructure, this domain was registered via NameSilo, LLC and had a Let's Encrypt SSL certificate.

PhishDestroy added this domain to its blocklist after first detecting it on June 20, 2026. This early detection is crucial, as phishing domains often exploit the 24-72 hour window between registration and antivirus database updates. During this period, such domains can evade many security measures, highlighting the importance of upstream threat intelligence.

The domain's page title, "Welcome to OpenResty!", suggests a generic setup page, possibly used to mask its true intent. With a platform risk score of 73 out of 100, t-mobile.dtvbsu.top represents a significant threat level. The combination of a high risk score and multiple vendor detections indicates a well-crafted phishing campaign aimed at exploiting T-Mobile's brand trust. As the domain is currently offline, it no longer poses a direct threat, but its previous activity serves as a reminder of the persistent risks posed by phishing operations.