t-mobile[.]gyftxi[.]top

This domain, t-mobile.gyftxi.top, is identified as a generic phishing site designed to impersonate T-Mobile, a telecommunications provider. The threat type is credential harvesting, likely targeting users through deceptive login portals or fraudulent account verification prompts. No specific drainer kit signatures were detected in initial scans, though the infrastructure aligns with common phishing frameworks leveraging Cloudflare hosting to obscure origin servers. Analysis indicates the domain was registered on May 30, 2026, through NameSilo, LLC, an uncommonly future-dated creation timestamp suggesting potential typosquatting or preemptive registration for malicious use. It resolves to IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.), a frequent choice for threat actors due to its proxy services. The domain lacks an SSL certificate, increasing the likelihood of interception or man-in-the-middle attacks. Google Safe Browsing explicitly flags it as phishing, while VirusTotal reports 24 out of 95 security vendors detecting malicious activity. The domain appears on one security blocklist, specifically PhishDestroy, and presents a default OpenResty page title, which may indicate incomplete deployment or a placeholder for future malicious content. As of the latest assessment, t-mobile.gyftxi.top has been taken offline, likely following abuse reports or automated takedown procedures. However, residual risk persists due to the domain's registration remaining active until 2026, allowing potential reactivation. Users who interacted with the domain should assume credential compromise and initiate password resets for associated accounts. Network administrators are advised to block the domain and its resolving IP (188.114.96.3) at the perimeter, while monitoring for related indicators such as the registrar (NameSilo, LLC) or future domains resolving to the same IP range.