t-mobile[.]cghqmr[.]top

This domain, t-mobile.cghqmr.top, is actively engaged in credential phishing operations targeting users of a major telecommunications provider. The site presents a fraudulent login interface designed to harvest account credentials, including usernames and passwords. Analysis indicates the domain is structured to deceive visitors into believing they are accessing a legitimate service portal, which poses a significant risk of unauthorized account access and subsequent data theft or financial fraud. Infrastructure analysis reveals the domain was registered on May 28, 2026, through NameSilo, LLC, an uncommon creation date that may indicate an attempt to evade detection. The domain resolves to IP address 188.114.97.3, hosted on Cloudflare infrastructure (AS13335), and currently lacks an SSL certificate, increasing the likelihood of interception during data transmission. VirusTotal data shows 11 out of 95 security vendors have flagged this domain as malicious, while Google Safe Browsing and one additional security blocklist have also classified it as phishing. If you have visited t-mobile.cghqmr.top or entered any credentials, immediate action is required. Disconnect the affected device from the network to prevent potential lateral movement. Reset all passwords associated with the compromised account, particularly those used for financial services or email. Enable multi-factor authentication where available. Monitor accounts for unauthorized activity and report any suspicious transactions to the relevant service provider. Consider scanning the device for malware using updated security tools to ensure no additional compromise has occurred.