t-mobile[.]pubtjf[.]top

The domain t-mobile.pubtjf.top was flagged as a brand impersonation threat targeting Google. This phishing campaign specifically aims to deceive users into believing they are interacting with a legitimate Google service, potentially harvesting credentials or sensitive information. The domain was registered through NameSilo, LLC and is now offline, but its previous activity posed significant risk.

Technical indicators reveal that 15 out of 95 security vendors on VirusTotal flagged this domain as malicious, and it appears on one security blocklist. Google Safe Browsing also flags it for phishing. The domain was created on May 21, 2026, and resolves to IP address 172.67.134.104. It uses an SSL certificate from Let's Encrypt (E7). The page title observed was "Welcome to OpenResty!", which is unusual for a Google impersonation and may indicate a multi-purpose or compromised server.

As of the latest intelligence, the domain has been taken offline, mitigating immediate risk. However, users who may have visited the site before it was shut down should remain vigilant for any signs of account compromise. PhishDestroy recommends that users avoid interacting with such domains and report any suspicious URLs to security teams. No drainer kit was identified, but the impersonation of a major brand like Google warrants ongoing awareness and caution.