t-mobile[.]uxlnry[.]top

This domain, t-mobile.uxlnry.top, operates as a high-risk phishing site specifically designed to mimic T-Mobile's authentication portals. Analysis indicates the site targets mobile subscribers by presenting fraudulent login interfaces that harvest credentials, payment details, and personal information. The domain's infrastructure and content structure closely resemble legitimate T-Mobile pages, increasing the likelihood of successful deception among unsuspecting users. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain was registered on May 30, 2026, through NameSilo, LLC, with an anomalous future creation date suggesting potential registrar manipulation or typo-squatting tactics. It currently resolves to IP address 188.114.97.3, hosted on Cloudflare's network (AS13335), which is commonly abused by threat actors to conceal origin servers. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious, while PhishDestroy and Google Safe Browsing both classify it as phishing. Notably, the site lacks any SSL certificate, exposing all transmitted data to interception, and displays the default OpenResty welcome page, indicating either misconfiguration or deliberate obfuscation of its true purpose. Users who have visited t-mobile.uxlnry.top should immediately take protective measures. First, cease all interaction with the site and avoid entering any credentials or personal information. If login details were submitted, immediately change passwords for T-Mobile accounts and any other services where identical credentials may have been reused. Monitor financial statements for unauthorized transactions and enable multi-factor authentication on all critical accounts. Organizations should add the domain to web filtering systems and block the IP address 188.114.97.3 at the network perimeter. Given the domain's active status and high-risk classification, security teams should treat any connection attempts to this infrastructure as potential compromise indicators and investigate accordingly.