t-mobile[.]xyrjqo[.]top

This domain, t-mobile.xyrjqo.top, operates as a high-risk phishing portal designed to impersonate official T-Mobile authentication pages. Analysis indicates the site employs social engineering tactics to harvest user credentials, payment details, or other sensitive information under the guise of a legitimate mobile carrier login interface. The presence of a branded login form, combined with the domain's deceptive naming convention, suggests a targeted campaign aimed at customers of the telecom provider. Infrastructure analysis reveals the use of Cloudflare services, which may obscure the true origin of the attack and complicate takedown efforts. Evidence supporting the malicious classification includes detection by 18 out of 95 security vendors on VirusTotal, with Google Safe Browsing specifically flagging the domain for SOCIAL_ENGINEERING. The domain was registered on May 28, 2026, through NameSilo, LLC, a registrar frequently associated with abusive registrations. It resolves to the IP address 188.114.97.3 and appears on at least one security blocklist. The page title, Welcome to OpenResty, further indicates the use of a web server commonly exploited for phishing infrastructure due to its flexibility and low detection rates. Users who have visited t-mobile.xyrjqo.top or entered credentials on the site should immediately revoke any submitted information by changing passwords for associated accounts, particularly those linked to financial services or email. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized transactions or login attempts from unfamiliar locations. If payment details were entered, contact the relevant financial institution to report potential fraud and request account monitoring or card replacement. Report the domain to local cybersecurity authorities or the impersonated brand to aid in broader mitigation efforts.