t-mobile[.]ksoitp[.]name

This domain, t-mobile.ksoitp.name, is flagged as a high-risk generic phishing site designed to impersonate T-Mobile. Analysis indicates the infrastructure is engineered to harvest user credentials through spoofed login portals, likely leveraging social engineering tactics to deceive victims into entering sensitive account information. The domain does not exhibit overt signs of a drainer kit but employs standard phishing page templates to mimic legitimate T-Mobile authentication flows. No direct association with known phishing frameworks (e.g., Evilginx, LogoKit) has been confirmed, though the technical execution aligns with common credential theft campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Dominet (HK) Limited, a registrar frequently observed in phishing operations. It resolves to IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.), a network often abused for its anonymization and DDoS protection capabilities. The SSL certificate is issued by Google Trust Services (WE1), providing a veneer of legitimacy while obscuring the malicious intent. Google Safe Browsing explicitly flags the domain as phishing, and it appears on one security blocklist, with VirusTotal reporting 18 of 95 security vendors detecting it as malicious. The page title, 'Suspected phishing site | Cloudflare,' suggests Cloudflare’s internal systems have also identified the domain as suspicious, though it remains operational. Current status indicates the domain is active and poses a persistent threat to users. Response actions should include immediate blacklisting by network security controls, DNS sinkholing, and browser-based blocking to prevent access. Organizations are advised to monitor for credential reuse attempts, particularly targeting T-Mobile accounts, and to implement multi-factor authentication (MFA) as a mitigating control. Despite Cloudflare’s hosting, the domain’s registration details and rapid detection by security vendors suggest it is part of a short-lived phishing campaign, though its longevity remains uncertain. Remaining risk includes potential lateral movement from compromised credentials, underscoring the need for proactive threat hunting and user awareness training.