t-mobile[.]xhaqfs[.]top

The domain t-mobile.xhaqfs.top is identified as a potential credential theft site and is currently offline. This domain appears to impersonate T-Mobile, a well-known telecommunications brand, which is a common tactic used by cybercriminals to deceive users and steal sensitive information.

Analysis indicates that t-mobile.xhaqfs.top has been flagged by 21 of 95 VirusTotal vendors, suggesting a significant level of suspicion among security experts. The domain is registered through NameSilo, LLC, and resolves to the IP address 188.114.97.3. It was created on May 29, 2026, and appears on one security blocklist. The page title, 'Welcome to OpenResty!', is an indicator that the site may be using the OpenResty web platform, which can be configured to serve various types of content, including malicious pages. The lack of an SSL certificate further diminishes the trustworthiness of the site, as legitimate services typically use SSL to secure communications.

Given that the domain is currently offline, users are advised to avoid accessing it and to report any attempts to reach out through this domain to their respective security teams. Organizations should update their security policies to block this domain and monitor network traffic for any signs of its reactivation. Additionally, users should be educated on recognizing brand impersonation tactics and the importance of verifying the legitimacy of URLs before entering any personal or sensitive information.