t-mobile[.]rmlcws[.]top

This domain, t-mobile.rmlcws.top, is flagged as a high-risk phishing site designed to harvest T-Mobile customer credentials. Analysis indicates the domain impersonates T-Mobile login portals, likely aiming to capture usernames, passwords, and potentially two-factor authentication codes. The page title, 'Welcome to OpenResty!', suggests default server configuration exposure, which may indicate rushed deployment or poor operational security by the threat actor. No drainer kit signatures or cryptocurrency wallet addresses were observed in initial scans, but the domain structure and naming convention align with credential-theft campaigns targeting mobile carriers. Infrastructure analysis reveals the domain was registered on May 29, 2026, through NameSilo, LLC, an uncommon registrar choice for legitimate T-Mobile properties. It resolves to IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335), a common tactic to obscure origin servers and evade takedowns. The domain is currently flagged by 25 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly marking it as phishing. It appears on one security blocklist and is actively blocked by PhishDestroy. Notably, the domain lacks an SSL certificate, which is atypical for modern phishing sites and may reduce victim trust or trigger browser warnings. As of the latest verification, t-mobile.rmlcws.top remains active and accessible. No sinkholing or DNS-based takedown has been observed, and the Cloudflare IP continues to respond to requests. Organizations should implement DNS-level blocking for this domain and its associated IP address. End users who may have interacted with the site should be instructed to reset credentials immediately, enable multi-factor authentication where available, and monitor accounts for unauthorized activity. Given the domain’s recent registration and active status, continued monitoring for related infrastructure or follow-on campaigns is recommended.