t-mobile[.]rnkbgt[.]top

This domain, t-mobile.rnkbgt.top, is actively engaged in credential harvesting phishing operations targeting users of a major telecommunications provider. The site presents a fraudulent login interface designed to mimic legitimate authentication portals, capturing entered credentials for unauthorized access to accounts. Such campaigns typically lead to account takeovers, financial fraud, or further exploitation through social engineering tactics. Users who interact with this domain risk exposure of sensitive personal and financial information, potentially resulting in identity theft or unauthorized transactions. Analysis indicates this domain was registered on May 15, 2026, through NameSilo, LLC, a registrar frequently associated with malicious infrastructure. The domain resolves to the IP address 188.114.96.3, hosted behind CloudFlare, Inc., which is commonly used to obscure the true origin of phishing servers. Detection metrics from VirusTotal show that 9 out of 95 security vendors have flagged this domain as malicious, while it also appears on at least one security blocklist. The SSL certificate, issued by Let's Encrypt, provides encrypted connections but does not validate the legitimacy of the site. The page title, 'Welcome to OpenResty!', suggests the use of a reverse proxy or web server software often employed in phishing kit deployments. Individuals who have visited t-mobile.rnkbgt.top or entered credentials on this site should immediately take corrective action. First, cease all interaction with the domain and avoid clicking any links or downloading attachments from suspicious sources. Next, change passwords for any accounts accessed from the compromised device, prioritizing email, financial, and telecommunications services. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unauthorized activity, such as logins from unfamiliar locations or devices, and report any suspicious transactions to the relevant service provider. If personal or financial data was exposed, consider placing a fraud alert or credit freeze with major credit bureaus to prevent further misuse.