t-mobile[.]xdmuny[.]top

This domain, t-mobile.xdmuny.top, is identified as a high-risk credential phishing site targeting T-Mobile users. Analysis indicates the infrastructure is designed to mimic legitimate telecommunications login portals, likely harvesting credentials, payment details, or personal identification information. The page title, Welcome to OpenResty!, suggests the use of OpenResty web server software, which is sometimes exploited in phishing kits for its flexibility and reverse proxy capabilities. No specific drainer kit signatures have been confirmed at this time, but the domain follows common phishing patterns associated with brand impersonation. Technical indicators reveal multiple red flags: the domain is flagged by 8 out of 95 security vendors on VirusTotal, indicating moderate to high detection confidence. It was registered through NameSilo, LLC, on May 17, 2026, with an unusually future creation date that may indicate domain spoofing or a typo in records. The domain resolves to IP address 172.67.153.218, hosted on Cloudflare infrastructure in Canada, which is frequently leveraged to obscure malicious origins. It appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt, providing HTTPS encryption that enhances the illusion of legitimacy while failing to validate the site's authenticity. As of the latest verification, t-mobile.xdmuny.top remains active, posing an ongoing threat to users. Response actions should include immediate blacklisting of the domain and IP across all security gateways, along with real-time monitoring for related infrastructure. The remaining risk is classified as high due to the domain's operational status, brand impersonation, and low blocklist coverage. Organizations are advised to implement DNS filtering, enforce strict certificate validation, and conduct user awareness training to mitigate exposure to similar phishing campaigns. No evidence of lateral movement or secondary payload delivery has been observed, but continuous analysis is recommended.