t-mobile[.]dmibgc[.]top

The domain t-mobile.dmibgc.top poses a significant threat by impersonating T-Mobile, a major telecommunications brand. Detected swiftly by PhishDestroy on June 17, 2026, just one day after its creation, the domain is flagged as malicious by 18 out of 95 VirusTotal vendors. Google Safe Browsing has also flagged this domain, underscoring its potential risk to users.

Hosted on a Cloudflare IP in the United States, the domain uses an SSL certificate issued by Google Trust Services, which may lend it an appearance of legitimacy. Despite this, its platform risk score is a maximum 100/100, indicating a high likelihood of malicious activity. The page currently displays a generic "Welcome to OpenResty!" message, which may be a placeholder as attackers prepare the phishing content.

The domain is registered with NameSilo, LLC, a registrar often used for quick and anonymous domain registrations. It is already included in one public blocklist, specifically PhishDestroy's, which highlights its rapid identification as a threat. The swift detection and multiple flags suggest that the domain is part of a coordinated phishing campaign targeting T-Mobile customers, aiming to harvest sensitive information like login credentials or payment details. The presence of such a domain emphasizes the need for continuous monitoring and quick response to emerging threats.