t-mobile[.]eblgrq[.]top

This domain is flagged as a credential harvesting phishing site targeting T-Mobile customers. Analysis indicates the site was designed to mimic legitimate login portals, tricking users into submitting account credentials, personal information, or payment details. The infrastructure was likely set up to exploit brand trust and urgency tactics commonly associated with mobile carrier scams. Infrastructure analysis reveals the domain was registered on May 29, 2026, through NameSilo, LLC, an unusually future-dated creation that may indicate bulk registration abuse. It resolves to IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335), a common tactic to obscure origin and evade takedowns. The site lacks an SSL certificate, increasing exposure to interception. Security vendors on VirusTotal flagged the domain 24 times out of 95 scans, with Google Safe Browsing and one additional blocklist confirming phishing activity. The page title, 'Welcome to OpenResty!', suggests default server software exposure, often seen in hastily deployed phishing kits. Users who visited t-mobile.eblgrq.top should assume credential exposure. Immediately reset passwords for any accounts entered on the site, prioritizing email, banking, and mobile carrier logins. Enable multi-factor authentication where available. Monitor financial statements and credit reports for unauthorized activity. Report the incident to relevant fraud teams and consider a device scan for malware if suspicious downloads occurred. Organizations should block the domain and IP across security controls to prevent further access.