t-mobile[.]zxtyme[.]top

This domain is flagged as a high-risk phishing resource targeting T-Mobile customers. Analysis indicates it is designed to harvest credentials by mimicking legitimate T-Mobile authentication portals, a common tactic in credential theft campaigns. The domain currently presents a generic "Welcome to OpenResty!" page, which may indicate either a staging environment or a placeholder for future malicious content deployment. Infrastructure analysis reveals the following technical indicators: registered through NameSilo, LLC on May 28, 2026, with an anomalous future creation date suggesting potential domain spoofing or registry manipulation. The domain resolves to IP address 188.114.97.3, hosted on Cloudflare infrastructure (AS13335), and lacks SSL encryption, increasing exposure to interception. Security vendor detections on VirusTotal report 12/95 flags, while Google Safe Browsing classifies it as phishing. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. The absence of a valid SSL certificate and the use of Cloudflare IP space are consistent with evasion techniques observed in phishing operations. Mitigation steps for this threat include immediate blocking of the domain and its resolving IP (188.114.97.3) at network perimeter controls. Security teams should monitor for credential submission attempts to this domain and implement multi-factor authentication (MFA) enforcement to mitigate account compromise risks. End-user awareness training should emphasize verification of domain authenticity before entering credentials, particularly for mobile carrier login portals. Given the anomalous registration date, further investigation into registrar abuse patterns is recommended, along with reporting the domain to relevant anti-phishing authorities for takedown.