t-mobile[.]ustqey[.]top

This domain, t-mobile.ustqey.top, is actively engaged in credential theft by impersonating T-Mobile, a major telecommunications provider. Visitors to this site are presented with fraudulent login pages designed to harvest usernames, passwords, and potentially other sensitive personal or financial information. The site mimics legitimate T-Mobile branding to deceive users into entering their credentials, which are then transmitted to threat actors for unauthorized access or further exploitation, such as account takeovers or identity theft. Analysis indicates this domain is a confirmed threat based on multiple technical indicators. It is flagged by 21 out of 95 security vendors on VirusTotal, confirming its malicious nature. The domain was registered on May 31, 2026, through NameSilo, LLC, an unusually future-dated registration that may indicate an attempt to evade detection or prolong malicious activity. Additionally, the domain resolves to the IP address 188.114.96.3, hosted on Cloudflare’s infrastructure (AS13335), which is frequently abused by threat actors to obscure their operations. The site lacks an SSL certificate, further signaling its illegitimacy and increasing the risk of data interception during transmission. If you or someone in your organization has visited t-mobile.ustqey.top, immediate action is required to mitigate potential damage. First, do not enter any credentials or personal information on the site. If credentials were already submitted, reset passwords for T-Mobile accounts and any other services where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all critical accounts to add an additional layer of security. Monitor accounts for unauthorized activity, such as unusual login attempts or changes to account settings. Report the incident to your organization’s security team or a trusted cybersecurity professional for further investigation and remediation. Additionally, consider scanning affected devices for malware, as credential theft sites may deploy additional payloads to maintain persistence or exfiltrate further data.