t-mobile[.]tighzu[.]top

This domain, t-mobile.tighzu.top, is flagged as a high-risk credential phishing site specifically targeting T-Mobile customers. Analysis indicates the infrastructure is designed to mimic legitimate T-Mobile login portals, likely to harvest user credentials, payment details, or personal identification information. The page title, 'Welcome to OpenResty!', suggests the use of OpenResty web server software, which is often employed in phishing kits for its flexibility and ease of deployment. No specific drainer kit has been identified, but the domain exhibits characteristics consistent with generic phishing frameworks, including the absence of a valid SSL certificate and reliance on Cloudflare infrastructure to obfuscate its true origin. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on May 28, 2026, through NameSilo, LLC, a registrar frequently associated with malicious domains due to its low-cost and minimal verification requirements. It resolves to the IP address 188.114.96.3, which is hosted on Cloudflare's network (AS13335), a common tactic to evade IP-based blocking and obscure the true hosting provider. As of the latest scan, 11 out of 95 security vendors on VirusTotal have flagged this domain as malicious, while Google Safe Browsing explicitly classifies it as a phishing site. Additionally, the domain appears on one security blocklist, further corroborating its malicious intent. The domain remains active and poses a significant risk to unsuspecting users. Despite being flagged by multiple security mechanisms, the infrastructure continues to operate, indicating either delayed takedown efforts or the use of bulletproof hosting services. Immediate response actions should include blacklisting the domain and IP address across all security gateways, as well as notifying the registrar and Cloudflare for potential suspension. Users are advised to avoid interacting with the domain, verify website authenticity through official channels, and implement multi-factor authentication to mitigate credential theft risks. The remaining risk level is classified as high due to the domain's active status, confirmed phishing intent, and the potential for widespread user impact.