t-mobile[.]xnaki[.]cc

This domain, t-mobile.xnaki.cc, is flagged for brand impersonation targeting T-Mobile customers. The site presents itself as an official T-Mobile portal, likely designed to harvest login credentials or distribute malicious payloads under the guise of legitimate communication. Analysis indicates the domain was configured to exploit trust in the T-Mobile brand, potentially leading to account compromise or unauthorized access to sensitive user data. The page title, about:privatebrowsing, suggests an attempt to obscure its true purpose or evade detection by mimicking a browser state rather than displaying overt phishing content.

Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335), which is commonly leveraged to mask the true origin of malicious infrastructure. The domain currently appears on one security blocklist, while VirusTotal reports detection by 18 out of 95 security vendors, indicating moderate but growing awareness of its malicious nature. No SSL certificate was observed, further reducing its legitimacy and increasing the likelihood of interception or tampering during data transmission.

Users who visited t-mobile.xnaki.cc should immediately cease all interaction with the domain and assume any credentials or personal information entered may have been compromised. It is recommended to reset passwords for T-Mobile accounts and any other services where identical credentials were used, employing strong, unique passwords and multi-factor authentication where available. Monitoring for unauthorized transactions or account activity is advised, and affected individuals should report the incident to their financial institutions and relevant cybersecurity authorities. System scans using updated security tools are recommended to detect potential secondary infections or malware introduced through the phishing attempt.