t-mobile[.]vpziam[.]top

The domain t-mobile.vpziam.top is actively engaged in credential theft through T-Mobile brand impersonation. Analysis confirms the domain is currently live and designed to harvest user login credentials by mimicking legitimate T-Mobile authentication portals. The infrastructure is classified as high-risk due to its deceptive branding and ongoing operational status, posing immediate threats to unsuspecting users. Infrastructure analysis reveals the domain was registered on May 19, 2026, through NameSilo, LLC, and resolves to the IP address 188.114.96.3, hosted by a content delivery network provider in Canada. Security vendors have flagged the domain, with 15 of 95 VirusTotal engines detecting malicious activity. The domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (serial number E7), does not mitigate the risk due to the lack of domain validation rigor. The page title, 'Welcome to OpenResty!', suggests the use of a reverse proxy or web server software commonly exploited for phishing infrastructure. Current status indicates the domain remains active and unblocked by most security filters, increasing the likelihood of successful credential harvesting. Organizations and individuals are advised to implement immediate countermeasures, including blocking the domain and IP at the network level, updating endpoint protection signatures, and conducting user awareness training focused on recognizing brand impersonation tactics. Monitoring for similar domains registered through NameSilo or resolving to 188.114.96.3 is recommended to identify related threats. Users who may have interacted with the domain should reset credentials and enable multi-factor authentication on all accounts.