t-mobile[.]hqnsjk[.]top

This domain, t-mobile.hqnsjk.top, poses a high-risk credential theft threat by impersonating T-Mobile’s official login portal. Attackers use this site to harvest usernames, passwords, and potentially multi-factor authentication codes from unsuspecting users. The site mimics T-Mobile’s branding, including logos, color schemes, and login interfaces, to deceive visitors into entering sensitive account credentials. Such stolen data is often exploited for unauthorized account access, financial fraud, or sold on underground markets for further malicious activity. Analysis indicates this domain was registered on May 3, 2026, through NameSilo, LLC, a registrar frequently abused for phishing infrastructure. It resolves to the IP address 172.67.130.25, hosted on Cloudflare’s network (AS13335), which is commonly used to obfuscate malicious activities. The domain is flagged by 19 out of 95 security vendors on VirusTotal, including detections for phishing and brand impersonation. Additionally, it appears on one security blocklist and is explicitly labeled as phishing by Google Safe Browsing. The SSL certificate, issued by Let’s Encrypt (serial number E8), provides a false sense of security while encrypting traffic to evade basic detection. If you visited t-mobile.hqnsjk.top or entered any credentials, take immediate action to mitigate risk. First, change the password for your T-Mobile account and any other accounts where the same credentials were reused. Enable multi-factor authentication if not already active. Monitor your account for unauthorized activity, such as unusual logins, changes to personal information, or unauthorized transactions. If financial data was entered, contact your bank or payment provider to report potential fraud. Scan your device for malware using a reputable security tool, as phishing sites may deploy additional payloads. Finally, report the incident to T-Mobile’s official fraud team and consider filing a report with relevant cybersecurity authorities to aid in tracking and takedown efforts.