t-mobile[.]srcyqf[.]shop

Analysis indicates t-mobile.srcyqf.shop operates as a brand impersonation phishing infrastructure targeting T-Mobile users. The page presents a generic OpenResty landing page, which is frequently associated with misconfigured or deliberately minimal phishing templates used to host credential capture flows. The threat type is classified as credential theft via brand impersonation.

Technical indicators show VirusTotal detection at 20/95 security vendors flagging the domain. The registrar is Dynadot Inc. The domain resolves to IP 104.21.17.187 under AS13335 (Cloudflare, Inc.). Google Safe Browsing explicitly flags the domain as phishing. The SSL certificate is issued by Google Trust Services (WE1). The domain appears on 1 security blocklist and is blocked by PhishDestroy. No creation date is provided in the dataset.

The domain is currently taken offline, limiting active exposure. However, historical compromise risk remains significant due to prior phishing classification and credential theft intent. Users who interacted with the domain should assume any entered credentials are compromised and perform immediate password resets on affected accounts. Multi-factor authentication should be enabled where possible, and session tokens should be revoked. Security monitoring should be applied to detect unauthorized login attempts. Network defenders should maintain blocking rules for 104.21.17.187 and the domain pattern t-mobile.srcyqf.shop, as Cloudflare-hosted infrastructure may allow rapid redeployment under alternate subdomains.