t-mobile[.]dovar[.]icu

This domain, t-mobile.dovar.icu, is a phishing site designed to steal T-Mobile customer credentials. Attackers created a fake login portal mimicking the legitimate T-Mobile website, tricking users into entering their usernames and passwords. Once submitted, the credentials are captured by the threat actors for unauthorized account access, financial fraud, or identity theft. The site specifically targets mobile users, often through SMS or email campaigns directing victims to the fraudulent domain. Analysis indicates the domain was registered on February 21, 2026, through Aceville Pte. Ltd., a registrar frequently used for malicious infrastructure. At the time of detection, 13 out of 95 security vendors on VirusTotal flagged the domain as malicious, confirming its phishing intent. The site resolved to 104.21.79.170, hosted on Cloudflare’s network (AS13335), which is commonly leveraged to obscure the true origin of phishing servers. The SSL certificate, issued by Google Trust Services (WE1), further mimics legitimacy to evade user suspicion. If you visited t-mobile.dovar.icu or entered any login details, take immediate action. First, change your T-Mobile account password using a secure device and enable multi-factor authentication if not already active. Monitor your account for unauthorized transactions or changes, and report any suspicious activity to T-Mobile’s fraud team. Additionally, scan your device for malware, as phishing sites may distribute malicious payloads. Avoid clicking on links in unsolicited messages, and verify website authenticity by checking the URL and SSL certificate details before entering credentials.