t-mobile[.]cyzpre[.]top

The domain t-mobile.cyzpre.top is a T-Mobile brand impersonation threat designed for credential theft, currently taken offline. It was registered on May 20, 2026 through NameSilo, LLC and resolved to IP address 104.21.50.104. The page displayed a generic 'Welcome to OpenResty!' title, which is a common default page for the OpenResty web platform, indicating the phishing kit may have been misconfigured or taken down before full deployment.

Security analysis reveals that this domain appears on 1 security blocklist and was flagged by 9 of 95 VirusTotal vendors as malicious. The SSL certificate was issued by Let's Encrypt with identifier E8, which is typical for quickly set up phishing sites. The use of a subdomain under 'cyzpre.top' mimics T-Mobile's legitimate domain structure to deceive users into entering their credentials. The low blocklist count suggests the domain was relatively new and not widely detected at the time of analysis.

Given the elevated risk level and confirmed credential theft targeting, users who may have interacted with this domain should change their T-Mobile account passwords immediately and enable two-factor authentication. PhishDestroy advises monitoring for any suspicious activity on accounts associated with T-Mobile and reporting any phishing attempts to the appropriate authorities. Avoid clicking on links from unsolicited messages and always verify the URL before entering sensitive information.