t-mobile[.]fswiyv[.]top

The domain t-mobile.fswiyv.top has been identified as a brand impersonation threat targeting T-Mobile, a major telecommunications provider. Analysis confirms the domain was designed to deceive users into believing they are interacting with an official T-Mobile platform, likely for credential harvesting or fraudulent transactions. As of the latest assessment, the domain is offline, though prior activity and infrastructure indicators remain relevant for forensic analysis. Infrastructure analysis reveals the domain was registered on May 15, 2026, through NameSilo, LLC, a registrar frequently associated with low-reputation domains. It resolves to the IP address 188.114.97.3, hosted under CloudFlare, Inc. in Canada, a common tactic to obscure origin servers. The domain is flagged by 17 of 95 security vendors on VirusTotal, with one confirmed appearance on a security blocklist. The SSL certificate, issued by Let's Encrypt (serial number E8), provides minimal assurance, as such certificates are easily obtainable and often exploited by malicious actors. The page title, 'Welcome to OpenResty!', suggests the use of a default or misconfigured web server, a red flag for hastily deployed phishing infrastructure. The risk level for this domain is classified as elevated due to its direct impersonation of a high-profile brand and confirmed detection by multiple security vendors. While the domain is currently offline, organizations and security teams should remain vigilant for re-emergence under similar naming conventions or infrastructure. Recommended actions include monitoring for DNS resolution changes, updating blocklists to include the domain and associated IP, and conducting retrospective log analysis to identify prior interactions. End users should be advised to verify domain authenticity before entering credentials and to report any suspicious communications claiming affiliation with T-Mobile.