t-mobile[.]njmgtq[.]top

This domain, t-mobile.njmgtq.top, is actively engaged in credential theft through brand impersonation of T-Mobile. Analysis indicates the site is designed to harvest user login credentials by presenting a fraudulent interface mimicking the legitimate telecommunications provider. The infrastructure is structured to deceive visitors into entering sensitive account details, which are then exfiltrated to attacker-controlled servers for unauthorized access or financial exploitation. Such campaigns often target mobile users with urgent prompts or fake account alerts to lower victim vigilance. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on May 18, 2026, through NameSilo, LLC, a registrar frequently associated with phishing operations. It resolves to the IP address 188.114.97.3, hosted on CloudFlare infrastructure in Canada, which is commonly leveraged to obscure attacker origins. The domain appears on one security blocklist and is flagged by 9 out of 95 security vendors on VirusTotal, including detections for credential theft and brand impersonation. The SSL certificate, issued by Let's Encrypt (serial number E7), further corroborates the active status of the threat, as attackers often use valid certificates to lend false legitimacy to phishing pages. Users who have visited t-mobile.njmgtq.top or entered credentials on the site should take immediate action to mitigate risk. First, reset passwords for any accounts accessed through the domain, prioritizing T-Mobile and other high-value services. Enable multi-factor authentication (MFA) where available to prevent unauthorized access. Monitor linked accounts for suspicious activity, such as unauthorized transactions or password change notifications. If financial information was entered, contact relevant institutions to report potential fraud. Additionally, scan devices used to access the domain for malware, as credential theft sites may deploy secondary payloads. Report the domain to security teams or abuse contacts for further investigation and takedown efforts.