t-mobile[.]sokqtg[.]top

This domain, t-mobile.sokqtg.top, is identified as a high-risk phishing infrastructure specifically designed to impersonate T-Mobile, a major telecommunications provider. The threat type is classified as generic phishing, with a primary objective of harvesting customer credentials, payment details, or personal information through deceptive login portals or fraudulent account management pages. As of the latest verification, the domain has been taken offline, though residual risks may persist through cached content or secondary distribution channels. Infrastructure analysis reveals multiple critical indicators of compromise. The domain was registered through NameSilo, LLC on May 28, 2026, an unusually forward-dated creation timestamp that suggests potential domain spoofing or preemptive registration for malicious campaigns. It resolves to the IP address 104.21.15.23, a Cloudflare-associated endpoint commonly exploited to mask origin servers and evade detection. The domain appears on one security blocklist, while VirusTotal reports 22 of 95 security vendors flagging it as malicious—a significant detection ratio indicative of confirmed phishing activity. Notably, the page title, 'Welcome to OpenResty!', suggests the use of a misconfigured or intentionally exposed reverse proxy server, often leveraged in phishing kits to serve cloned login interfaces. The absence of an SSL certificate further undermines any semblance of legitimacy, as modern phishing domains typically employ fraudulent or self-signed certificates to mimic secure connections. Current status confirms the domain is offline, reducing immediate exposure to end users. However, the underlying infrastructure may remain active or be repurposed for future campaigns. Organizations and individuals are advised to implement proactive countermeasures, including blocking the domain and its resolving IP at the network perimeter, updating endpoint protection signatures to include this indicator of compromise, and monitoring for related subdomains or typosquatting variants. Users who may have interacted with this domain should immediately reset credentials for any associated accounts, enable multi-factor authentication where available, and review financial statements for unauthorized transactions. Security teams are encouraged to correlate this domain with other threat intelligence feeds to identify potential campaign linkages or secondary attack vectors.