t-mobile[.]brcpkv[.]top

This domain, t-mobile.brcpkv.top, operates as a credential theft campaign designed to impersonate T-Mobile’s official infrastructure. Analysis indicates the site presents a fraudulent login interface, tricking users into submitting sensitive account credentials, including usernames, passwords, and potentially multi-factor authentication codes. The campaign likely targets mobile customers under the guise of account verification, billing updates, or security alerts, exploiting brand recognition to increase success rates. Such credential harvesting can lead to unauthorized account access, financial fraud, or further targeted attacks using stolen personal data. Infrastructure analysis reveals the domain was registered on May 28, 2026, through NameSilo, LLC, a registrar commonly associated with high-risk domains. It resolves to the IP address 172.67.163.249 and is proxied behind Cloudflare, a tactic frequently used to obscure hosting origins and evade detection. The domain appears on one security blocklist and is flagged by 14 out of 95 security vendors on VirusTotal, with Google Safe Browsing categorizing it under SOCIAL_ENGINEERING. The page title, Welcome to OpenResty!, suggests the use of a reverse proxy or web server software, which may be leveraged to serve dynamic phishing content or bypass basic security checks. Users who visited t-mobile.brcpkv.top should immediately cease all interaction with the site and assume their credentials may have been compromised. Affected individuals are advised to reset passwords for their T-Mobile accounts and any other services where identical credentials were reused. Enabling multi-factor authentication on all critical accounts is strongly recommended to mitigate further risk. If financial or personal information was entered, monitoring for unauthorized transactions or identity theft is necessary. Reporting the incident to the impersonated brand’s security team can aid in broader mitigation efforts.