t-mobile[.]ymbjqc[.]top

The domain t-mobile.ymbjqc.top is identified as a high-risk phishing site specifically designed to impersonate T-Mobile, a major telecommunications provider. Analysis indicates the site was actively harvesting user credentials through a fake login portal before being taken offline. The infrastructure was configured to mimic legitimate T-Mobile authentication pages, increasing the likelihood of successful deception. Infrastructure analysis reveals the domain was registered on May 29, 2026, through NameSilo, LLC, an uncommon creation date suggesting potential obfuscation. It resolved to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. The site lacked an SSL certificate, a red flag for user security. Detection metrics show 23 of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing and one additional blocklist also marked it as phishing. The page title, 'Welcome to OpenResty!', further indicates misconfigured or intentionally obscured server software. Currently, t-mobile.ymbjqc.top has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations are advised to block the domain and associated IP at the network level, monitor for credential reuse from affected accounts, and educate users on recognizing brand impersonation tactics. Security teams should review logs for connections to 188.114.97.3 during the active period and assess potential exposure.