t-mobile[.]xoumzj[.]shop

This domain, t-mobile.xoumzj.shop, operates as a credential harvesting phishing site targeting users of a major telecommunications provider. Analysis indicates the site presents a fraudulent login interface designed to capture usernames, passwords, and potentially multi-factor authentication codes. The page title, 'Welcome to OpenResty!', suggests the use of OpenResty web server software, commonly employed to host phishing kits due to its flexibility and ease of deployment. Infrastructure analysis reveals the domain resolves to IP address 172.67.167.233, hosted on Cloudflare's network (AS13335). The SSL certificate, issued by Google Trust Services (WE1), was likely automated to lend an appearance of legitimacy. Detection metrics show 19 out of 95 security vendors on VirusTotal flag the domain as malicious, while Google Safe Browsing classifies it as phishing. The domain appears on one security blocklist and was recently taken offline, though historical records confirm its active malicious use. Users who accessed t-mobile.xoumzj.shop should assume credential compromise. Immediate actions include resetting passwords for the impersonated service and any accounts where identical credentials were reused. Enable multi-factor authentication where available. Monitor financial and communication accounts for unauthorized activity, as phishing sites of this nature often lead to secondary attacks such as SIM swapping or fraudulent transactions. Network administrators should block the domain and associated IP at perimeter defenses to prevent further exposure.