t-mobile[.]armctz[.]top

This domain, t-mobile.armctz.top, is identified as a high-risk credential harvesting phishing site designed to impersonate a legitimate mobile carrier portal. Analysis indicates the infrastructure is engineered to deceive users into submitting sensitive login credentials, payment details, or personal information through a fraudulent interface. The domain mimics trusted branding and login workflows, a common tactic in targeted phishing campaigns aimed at mobile subscribers. The absence of an SSL certificate further increases the risk of data interception during transmission, exposing victims to account compromise and identity theft. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain resolves to IP address 104.21.20.90, hosted on Cloudflare infrastructure (AS13335), a pattern frequently observed in phishing operations leveraging content delivery networks for anonymity and resilience. VirusTotal reports 21 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly categorizes it as phishing. The domain appears on one security blocklist and was registered on May 30, 2026, through NameSilo, LLC, an uncommon future date suggesting potential domain spoofing or registration timestamp manipulation. The page title, Welcome to OpenResty!, indicates the use of a reverse proxy server, often employed to obscure backend phishing kits or redirect traffic. Users who visited t-mobile.armctz.top should take immediate remedial action to mitigate potential exposure. If any credentials or personal information were entered, users must change passwords for all associated accounts, particularly those linked to mobile services, financial platforms, or email accounts. Enable multi-factor authentication where available to prevent unauthorized access. Monitor financial statements and account activity for signs of fraudulent transactions. Clear browser cache and cookies to remove any residual tracking elements. Organizations should update internal blocklists to include this domain and its associated IP address, and conduct security awareness training to educate users on recognizing phishing indicators such as unusual domain structures, missing SSL certificates, and mismatched branding.