t-mobile[.]bnayqs[.]top

This domain, t-mobile.bnayqs.top, operates as a fraudulent T-Mobile login portal designed to harvest credentials through brand impersonation. Analysis indicates the site mimics legitimate T-Mobile authentication pages, tricking users into entering sensitive account details under the pretense of account verification or security updates. The page title, 'Welcome to OpenResty!', suggests misconfigured or obfuscated server software, a common tactic in phishing infrastructure to evade detection or mask malicious intent.

Technical evidence confirms the domain's malicious nature. VirusTotal reports 19 out of 95 security vendors flagging t-mobile.bnayqs.top as malicious, with Google Safe Browsing specifically categorizing it under 'SOCIAL_ENGINEERING'. The domain was registered on May 20, 2026, through NameSilo, LLC, an uncommon registrar for legitimate corporate sites. It resolves to the IP address 188.114.97.3 and appears on one security blocklist, while also being blocked by PhishDestroy. The use of Cloudflare and HTTP/3 further indicates an attempt to obscure hosting details and leverage modern web protocols to bypass traditional security measures.

Users who visited t-mobile.bnayqs.top should assume their credentials may have been compromised. Immediate actions include changing passwords for any accounts accessed through the site, enabling multi-factor authentication where available, and monitoring linked accounts for unauthorized activity. If financial or personal data was entered, affected individuals should review transaction histories and consider placing fraud alerts with relevant institutions. The domain is currently offline, but users should remain vigilant for similar phishing attempts via email, SMS, or other communication channels impersonating T-Mobile or other trusted brands.