t-mobile[.]hpwnqk[.]top

This domain, t-mobile.hpwnqk.top, is identified as a high-risk phishing infrastructure designed to impersonate T-Mobile, a major telecommunications provider. Analysis indicates the site likely functions as a fake login portal, tricking users into submitting credentials under the pretense of account verification or security updates. No evidence of a crypto drainer kit was observed, but the presence of a generic OpenResty page title suggests the use of default web server configurations, often exploited in phishing campaigns to evade initial scrutiny. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335). It was registered on May 29, 2026, through NameSilo, LLC, a registrar frequently abused for malicious domains. Google Safe Browsing has flagged the domain as phishing, and it appears on one security blocklist. VirusTotal reports 24 out of 95 security vendors detecting the domain as malicious. Notably, the domain lacks an SSL certificate, a red flag for users accustomed to secure connections on legitimate sites. The domain is currently offline, likely due to takedown actions or abandonment by the threat actor. However, the infrastructure remains a residual risk, as similar domains may resurface under new names or IPs. Users who interacted with the site should assume credential exposure and initiate password resets, while organizations should monitor for related phishing domains using the same registrar or hosting patterns. Continuous vigilance is advised, as threat actors often recycle tactics and infrastructure.