t-mobile[.]auqisg[.]top

This domain, t-mobile.auqisg.top, is flagged as a high-risk credential harvesting phishing site targeting telecommunications account credentials. Analysis indicates the domain is designed to mimic legitimate login portals, employing social engineering tactics to deceive users into submitting sensitive authentication details. The threat type is classified as generic_phishing with a specific focus on credential theft, as corroborated by the presence of the page title 'Welcome to OpenResty!', which suggests the use of a reverse proxy to obscure backend infrastructure.

Infrastructure analysis reveals the domain was registered through NameSilo, LLC on May 18, 2026, an unusually future-dated creation that may indicate an attempt to evade detection or appear legitimate. It resolves to the IP address 104.21.45.4, a Cloudflare-associated endpoint, which is commonly exploited to mask the true origin of malicious traffic. Detection metrics show 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing explicitly categorizes it under 'SOCIAL_ENGINEERING'. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100, further confirming its fraudulent nature. Technologies detected include Cloudflare Browser Insights and HTTP/3, which are often leveraged to enhance the perceived legitimacy of phishing pages.

Mitigation steps for this specific threat type include immediate blacklisting of the domain and its associated IP address within enterprise security gateways. Network administrators should deploy DNS-based blocking rules to prevent resolution of t-mobile.auqisg.top and monitor for related subdomains or future registrations under the same registrar. End-users should be educated on identifying social engineering tactics, such as scrutinizing URL structures for irregularities and verifying the legitimacy of login portals through official channels. Organizations are advised to enforce multi-factor authentication to mitigate the impact of credential theft, even if phishing attempts succeed.