t-mobile[.]yzxhoq[.]top

The domain t-mobile.yzxhoq.top is identified as a brand impersonation phishing site designed to mimic T-Mobile login portals. Analysis indicates this domain is currently offline, though it previously hosted content intended to deceive users into submitting credentials or personal information under false pretenses. Infrastructure analysis reveals the domain was registered through NameSilo, LLC, and resolves to the IP address 172.67.136.211, hosted on Cloudflare's network (AS13335). The domain was created on May 28, 2026, an anomalous date suggesting potential manipulation of registration records. Security vendors on VirusTotal flagged this domain, with 21 of 95 engines detecting malicious activity. It appears on one security blocklist and lacks an SSL certificate, further indicating its illegitimate nature. The page title, 'Welcome to OpenResty!', suggests the use of a default or misconfigured web server, a common trait in hastily deployed phishing infrastructure. Current status confirms the domain is offline, reducing immediate risk to users. However, organizations and individuals are advised to block the domain and its resolving IP at the network level to prevent potential reactivation. Users who may have interacted with this domain should reset credentials for any accounts accessed during the exposure window. Monitoring for similar domains registered through NameSilo or resolving to Cloudflare IPs may help identify related threats. Network defenders should prioritize domains with anomalous creation dates or missing SSL certificates as potential indicators of phishing activity.