t-mobile[.]mgsclu[.]top

This domain, t-mobile.mgsclu.top, is identified as a high-risk credential harvesting phishing site designed to impersonate T-Mobile’s official login portal. Analysis indicates the infrastructure was established to deceive users into submitting sensitive authentication details, including usernames, passwords, and potentially multi-factor authentication codes. The absence of a valid SSL certificate and the presence of a default OpenResty page title suggest either incomplete deployment or deliberate evasion tactics to avoid immediate detection by automated security tools. The domain’s design and naming convention closely mimic legitimate T-Mobile subdomains, increasing the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals the domain was registered on May 29, 2026, through NameSilo, LLC, a registrar frequently associated with short-lived phishing campaigns. The domain resolves to the IP address 172.67.176.64, hosted on AS13335 Cloudflare, Inc., a network commonly utilized to obfuscate malicious infrastructure behind content delivery services. At the time of assessment, the domain appeared on one security blocklist and was flagged by Google Safe Browsing for phishing activity. VirusTotal detection metrics further corroborate the threat, with 23 out of 95 security vendors classifying the domain as malicious. The combination of these indicators—rapid registration, Cloudflare hosting, and multi-vendor detections—demonstrates a calculated effort to exploit brand trust while minimizing exposure to takedown efforts. Users who accessed or interacted with t-mobile.mgsclu.top should immediately assume their credentials were compromised. Affected individuals must reset passwords for T-Mobile accounts and any other services where identical credentials were reused. Multi-factor authentication tokens linked to the account should also be revoked and reissued. System scans using updated security tools are recommended to detect potential secondary payloads or persistent threats. Organizations should update internal blocklists to include this domain and its resolving IP address, while monitoring network logs for connections to 172.67.176.64 or related subdomains. Given the domain’s current offline status, continued vigilance is advised, as threat actors may redeploy similar infrastructure under new domains or IP addresses.