t-mobile[.]avrzmy[.]top

This domain, t-mobile.avrzmy.top, is a credential theft operation designed to impersonate T-Mobile’s official login portal. Analysis indicates the site harvests usernames, passwords, and potentially two-factor authentication codes by presenting a convincing but fraudulent interface. Victims who enter credentials risk account takeovers, unauthorized transactions, and identity theft, with stolen data often sold on underground forums or used for further attacks. Infrastructure analysis reveals multiple red flags confirming malicious intent. The domain was registered on May 30, 2026, through NameSilo, LLC, an unusually future-dated creation that suggests evasion tactics. It resolves to IP 172.67.193.36, hosted on Cloudflare’s network (AS13335), which is frequently abused by threat actors to obscure origin servers. VirusTotal reports 21 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing and PhishDestroy blocklists confirm phishing activity. The site lacks an SSL certificate, further exposing user data to interception, and displays the default OpenResty page title, indicating a hastily deployed or low-effort attack. Users who visited t-mobile.avrzmy.top should take immediate action to mitigate risks. First, reset passwords for any accounts accessed through the site, prioritizing T-Mobile and linked email addresses. Enable multi-factor authentication (MFA) using app-based or hardware tokens, not SMS, to prevent SIM-swapping attacks. Monitor financial statements and credit reports for unauthorized activity, as stolen credentials may lead to fraudulent transactions. If personal or payment information was entered, consider placing a fraud alert with credit bureaus. Report the incident to the impersonated brand’s security team and local cybercrime authorities to aid in takedown efforts. Avoid interacting with the domain further, and verify all future login portals by checking the URL and SSL certificate before entering credentials.