t-mobile[.]kacpnq[.]top

The domain t-mobile.kacpnq.top has been identified as a generic phishing threat, specifically designed to impersonate the T-Mobile brand in an attempt to steal personal or financial information from unsuspecting users. As of the latest analysis, this domain is currently offline, which indicates that it has been taken down or deactivated, likely due to the concerted efforts of security researchers and hosting providers. The domain was created on May 29, 2026, through the registrar NameSilo,LLC, a detail that underscores the relative newness of the phishing operation at the time it was active.

Technical indicators from multiple security sources paint a stark picture of risk. VirusTotal flagged this domain with 21 out of 95 security vendors, a strong consensus that the site is malicious. Google Safe Browsing specifically identified it as a phishing threat, while the domain lacked an SSL certificate, meaning any data transmitted would not be encrypted. The domain resolves to IP address 104.21.95.122 and appears on one security blocklist. These data points collectively confirm that t-mobile.kacpnq.top was engineered for credential harvesting and should be treated with extreme caution.

Given that the domain is now offline, the immediate risk to users is reduced, but the underlying threat infrastructure may still be active or repurposed. Security professionals recommend that users who may have interacted with this site change any passwords entered and monitor accounts for unauthorized activity. Organizations should ensure that their email and web filters block this domain and similar patterns. PhishDestroy advises maintaining robust anti-phishing awareness training to recognize such impersonation attempts, especially those leveraging well-known brands like T-Mobile.