t-mobile[.]vwrxch[.]top

This domain, t-mobile.vwrxch.top, is identified as a credential theft operation targeting users through T-Mobile brand impersonation. Analysis indicates the infrastructure was designed to harvest login credentials, payment details, or other sensitive information by mimicking legitimate T-Mobile authentication portals. The use of a subdomain under vwrxch.top, combined with the absence of a valid SSL certificate, suggests an attempt to evade detection while maintaining a superficial appearance of legitimacy. Evidence supporting this assessment includes detection by 22 of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly flagging the domain as phishing. The domain was registered through NameSilo, LLC, on May 30, 2026, an unusual future date that may indicate an attempt to bypass automated domain age filters. It resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335), and appears on at least one security blocklist. The page title, 'Welcome to OpenResty!', further suggests misconfigured or intentionally obfuscated server software, a common trait in hastily deployed phishing infrastructure. Users who visited t-mobile.vwrxch.top should assume their credentials or other sensitive data were compromised. Immediate steps include resetting passwords for any accounts accessed via the domain, enabling multi-factor authentication where available, and monitoring financial statements for unauthorized transactions. System scans using updated security tools are recommended to detect potential secondary infections. Organizations should block the domain and its resolving IP at the network level to prevent further exposure.