t-mobile[.]mnjeqr[.]top

This domain, t-mobile.mnjeqr.top, is identified as a high-risk phishing site designed to impersonate T-Mobile, a telecommunications brand. Analysis indicates the threat type is a fake login page, likely intended to harvest user credentials by mimicking legitimate T-Mobile authentication portals. The page title, 'Welcome to OpenResty!', suggests the use of a misconfigured or intentionally obscured web server, a common tactic in phishing infrastructure to evade detection or mislead analysts. No specific drainer kit signatures were observed, but the domain’s structure and impersonation tactics align with credential theft campaigns. Technical indicators reveal the domain was registered on May 14, 2026, through NameSilo, LLC, a registrar frequently abused for malicious registrations. It resolves to the IP address 188.114.96.3, hosted by CloudFlare, Inc. in Canada, which is often leveraged to conceal the true origin of malicious traffic. VirusTotal reports 16 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Let’s Encrypt (serial number E7), a common choice for both legitimate and malicious sites due to its free and automated issuance process. Google Safe Browsing (GSB) status is not explicitly provided, but the domain’s active phishing nature suggests it may be flagged there as well. As of the latest analysis, t-mobile.mnjeqr.top remains active, posing an ongoing risk to users who may encounter it through phishing emails, SMS campaigns, or malvertising. Immediate response actions should include blocking the domain at the DNS or network level, as well as monitoring for related indicators of compromise (IOCs) such as the resolving IP and SSL certificate. Despite its detection by multiple vendors, the domain’s continued operation underscores the need for user education on recognizing phishing attempts, particularly those impersonating trusted brands. Organizations should ensure endpoint protection and email filtering systems are updated to detect and mitigate such threats.