t-mobile[.]fbekgj[.]top

This domain, t-mobile.fbekgj.top, is identified as a credential theft operation impersonating T-Mobile, a major telecommunications provider. The site presents a fraudulent login interface designed to harvest user credentials, including usernames and passwords, by mimicking legitimate T-Mobile authentication portals. Analysis of the page structure and metadata reveals the use of deceptive elements, such as cloned branding and misleading URLs, to trick victims into disclosing sensitive information. The presence of a generic OpenResty welcome page suggests either an incomplete deployment or an attempt to obfuscate the true nature of the site during initial reconnaissance. Infrastructure analysis reveals critical technical indicators associated with this domain. The domain was registered on May 29, 2026, through NameSilo, LLC, a registrar frequently observed in malicious campaigns due to its low-cost and bulk registration capabilities. It resolves to the IP address 104.21.78.29, which is part of a network known for hosting phishing and fraudulent content. Detection metrics further underscore the threat level: 19 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist. The use of Cloudflare and HTTP/3 indicates an attempt to leverage modern web technologies to evade detection and enhance the site's perceived legitimacy. Users who visited t-mobile.fbekgj.top or entered credentials on this site should take immediate action to mitigate potential risks. First, all exposed credentials must be changed without delay, particularly for T-Mobile accounts or any other services where the same login details may have been reused. Affected individuals should enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitoring for unusual activity, such as unauthorized transactions or login attempts, is strongly advised. If financial or personally identifiable information was disclosed, users should consider reporting the incident to relevant authorities and credit monitoring agencies to prevent identity theft or fraud.