t-mobile[.]ezdnhg[.]top

This domain, t-mobile.ezdnhg.top, poses a targeted phishing threat through brand impersonation of T-Mobile, a major telecommunications provider. Analysis indicates the domain was designed to deceive users into entering credentials or personal information under the pretense of a legitimate T-Mobile service page. The use of a subdomain mimicking T-Mobile’s official branding increases the likelihood of successful social engineering, particularly among mobile users or customers expecting account-related communications. The presence of a generic OpenResty page title suggests the domain may have been part of a broader phishing infrastructure, potentially serving as a landing page for credential harvesting or redirection to malicious payloads. Evidence supporting the malicious classification includes detection by 21 out of 95 security vendors on VirusTotal, a creation date of May 28, 2026, and registration through NameSilo, LLC. The domain appears on one security blocklist and was blocked by PhishDestroy. Infrastructure analysis reveals the domain resolved to the IP address 104.21.56.75, hosted on Cloudflare’s network (AS13335), a common tactic to obscure the true origin of phishing infrastructure. Notably, the domain lacks an SSL certificate, which is atypical for legitimate services and further indicates malicious intent. The domain is currently offline, but its infrastructure may be repurposed or reactivated. Users who visited t-mobile.ezdnhg.top should assume potential exposure of credentials or personal data. Immediate actions include resetting passwords for any accounts accessed after visiting the domain, particularly T-Mobile or other sensitive accounts. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor financial and account activity for signs of fraudulent transactions or unauthorized logins. If credentials were entered, consider reporting the incident to the affected service provider and relevant authorities. Organizations should update security controls to block the domain and associated IP address (104.21.56.75) to prevent further exposure.