t-mobile[.]ndilcz[.]top

The domain t-mobile.ndilcz.top has been identified as a high-risk generic phishing threat, potentially targeting users with brand impersonation tactics. The domain's name suggests an attempt to mimic the T-Mobile brand, although no direct evidence of a complete phishing kit or specific drainer kit has been observed. Its use of a basic OpenResty web server page may indicate a placeholder or staging environment for future malicious activity. The absence of an SSL certificate further points to its illegitimacy and raises immediate security concerns for users who may interact with the site.

A detailed analysis of technical indicators reveals that the domain resolves to IP address 104.21.14.181, hosted under Cloudflare's infrastructure (AS13335) in the United States. It was registered through NameSilo, LLC and has a listed creation date of May 30, 2026, which appears to be an anomaly, potentially indicating an attempt to obscure legitimate registration timelines. The domain has been flagged by 25 out of 95 security vendors on VirusTotal and is currently blocked by PhishDestroy. Additionally, it has been included in at least one known security blocklist, and Google Safe Browsing flags it as a phishing domain. The lack of an SSL certificate further compounds the risks, making it easier for attackers to intercept sensitive data if unsuspecting users engage with the site.

As of the latest assessment, the domain remains active and poses a high risk to potential victims. Security teams should prioritize blocking access to this domain at both the network and endpoint levels. Users should be educated to avoid interacting with any communications or links associated with t-mobile.ndilcz.top. Organizations are advised to monitor for similar domains that may emerge, as this behavior often indicates broader phishing campaigns. Further investigation into the domain's hosting and registration details is recommended to identify additional infrastructure linked to this threat.