Security1 publisher2 min readPublished
Fake T-Mobile points-expiry texts rotated through at least 81 .top domains in four months
Malwarebytes has tracked the rewards-expiry smishing since early May 2026 and counted more than 1,000 template variants pointing at hostnames built as t-mobile plus six random letters under .top.
The Watch · Security desk
What happened
- Malwarebytes has been tracking a large SMS phishing campaign since early May 2026 in which texts falsely warn T-Mobile customers that their rewards points are about to expire.
- The company catalogued more than 1,000 closely related message templates at a semantic similarity of at least 0.60, with the 199 closest all scoring 0.95 or better.
- The links were very short-lived, with at least 81 domains burned over four months, all of them lookalike hostnames placing the T-Mobile name in front of a throwaway registration.
- Activity started slowly, produced two large spikes, and has fallen considerably since, though Malwarebytes says messages from the campaign are still arriving.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint A domain blocklist cannot keep up with a new hostname roughly every day and a half, so indicator ingestion is the wrong control for this traffic.
- decision Defenders have to choose between chasing registrations and writing two rules that hold: a regex on the hostname shape and a template match on the lure text.
- exposure Any T-Mobile customer with real points is one tap from a credential form, and the unnamed greeting is the one inconsistency they can check without leaving the message.
- capability Because the brand lives in a subdomain the attacker controls, impersonating a different company costs nothing beyond editing a text string.
Look at the hostnames. In the twelve examples Malwarebytes published, the registrable domain is six random lowercase letters under .top, and "t-mobile" is a subdomain label the operators own [10][11]. The brand string therefore sits at the left edge of the address, in front of the part a blocklist would key on.
At least 81 hostnames across roughly 120 days is a new one about every day and a half [8][12]. A feed built on registrable domains publishes its entries too late to catch the campaign. What holds still is the shape: the literal string "t-mobile." followed by six letters and .top. Malwarebytes says that pattern is blocked in its Browser Guard [9].
The message side rotates the same way. Of the 1,000-plus related templates, 199 scored at least 0.95 similarity, so fewer than one in five are near-duplicates and the rest sit further out on the 0.60 threshold [5][13]. The fields that move are the salutation, the headline word, the expiry date, and the balance [6]. Exact-string rules on the body will miss most of the traffic.
The invented balance is what makes it look account-specific. One sample text told the recipient: "You currently have 18,400 points, which will expire on June 4, 2026, if unused." [3] The template's expiry field is filled with today's or tomorrow's date, so every message lands with a deadline inside a day [4].
The checkable inconsistency is the greeting. Messages open with "Dear T-Mobile Customer," "Dear Valued Customer," or "T-Mobile User" [7]. The recipient's name appears nowhere, and neither does anything verifiable about the account. A real customer with real points has no way to tell 18,400 from their actual balance without opening the app. The deadline is there to skip that step. Malwarebytes advises entering no credentials, personal information, payment details, or verification codes after following a link in an unsolicited message [16].
On the volume question, the data Malwarebytes gathered through Text Protection in its Mobile Security product shows a slow start, two large spikes, and a considerable fall since, with messages still arriving [14][15]. The campaign ran a mass send and dressed each message to look singular. Malwarebytes published the activity curve but no detection counts, victim numbers, or attribution to a named actor [17].
What to watch
- Whether the same t-mobile-plus-six-letters .top pattern reappears with another carrier or bank brand in the leftmost label.
- Whether activity spikes a third time after the current decline Malwarebytes reports.
- Whether .top registrar or registry action shortens the life of these hostnames below the current day-and-a-half cadence.