t-mobile[.]pagqzm[.]top

This domain, t-mobile.pagqzm.top, is identified as a high-risk generic phishing portal actively impersonating T-Mobile. The site remains operational and is designed to deceive users into submitting sensitive credentials or personal information under the guise of the legitimate telecommunications provider. Analysis indicates the domain is currently serving a default OpenResty page, which may be a placeholder for a fully deployed phishing kit or an indicator of early-stage attack infrastructure. Infrastructure analysis reveals the domain was registered through NameSilo, LLC, and resolves to the IP address 172.67.184.180, hosted on Cloudflare’s network (AS13335). The domain was created on May 29, 2026, an anomalous future date suggesting potential registration data manipulation. It is flagged by 14 of 95 security vendors on VirusTotal, appears on one security blocklist, and is explicitly labeled as phishing by Google Safe Browsing. Notably, the domain lacks an SSL certificate, a deviation from standard security practices expected of legitimate services, particularly those handling user authentication. Current status confirms the domain remains active and unmitigated. The combination of brand impersonation, default web server response, and Cloudflare hosting—commonly used to obfuscate malicious infrastructure—elevates the risk profile. Organizations and users are advised to block access to t-mobile.pagqzm.top at the DNS or network level, monitor for credential exposure tied to this domain, and report the site to relevant abuse channels. End users should verify domain authenticity before entering login credentials and enable multi-factor authentication on all critical accounts to mitigate potential compromise.