t-mobile[.]vemcwf[.]top

This domain is assessed as high-risk due to its classification as a generic phishing infrastructure impersonating a known brand login flow. The observed service behavior and hosting setup indicate credential harvesting intent, with infrastructure patterns consistent with fake authentication portals. The page resolves to a default "Welcome to OpenResty!" response, which is commonly used as a placeholder or reverse proxy front in phishing deployments. Despite being currently taken offline, historical activity and detection signals indicate prior malicious usage rather than benign misconfiguration.

Technical indicators confirm elevated risk. VirusTotal reports 23/95 security vendors flagging the domain as malicious. The domain was registered on May 29, 2026 through NameSilo,LLC. Network resolution points to IP address 188.114.96.3, located under AS13335 Cloudflare, Inc. in the US. The domain currently has no SSL certificate present, increasing suspicion for insecure or transient deployment patterns. Additional intelligence shows the domain appears on 1 security blocklist and is explicitly blocked by PhishDestroy. The combination of brand impersonation, phishing classification, and moderate multi-engine detection coverage reinforces its malicious assessment.

Mitigation requires immediate avoidance of any interaction with the domain or related redirects. Users should not enter credentials or authentication data, as the infrastructure is consistent with fake login capture workflows. Any accounts potentially exposed through interaction should have passwords reset immediately and multi-factor authentication enabled. Network defenders should maintain blocking rules for the domain and associated IP 188.114.96.3, and monitor for similar subdomain patterns under vemcwf.top. Given the domain is currently offline, retrospective hunting across logs is recommended to identify prior access attempts or credential submission events.