t-mobile[.]sgepld[.]top

The domain t-mobile.sgepld.top is an active phishing site designed to impersonate T-Mobile, a major telecommunications provider. Analysis indicates this infrastructure is explicitly crafted to harvest user credentials, payment details, or personal information through deceptive login portals. The domain remains operational and poses a high-risk threat to unsuspecting visitors. Infrastructure analysis reveals the domain was registered on May 15, 2026, through NameSilo, LLC, an uncommon future registration date that may indicate an attempt to evade detection or domain reputation tracking. It resolves to the IP address 172.67.204.220, hosted on Cloudflare infrastructure in Canada, which is frequently leveraged to obscure the true origin of malicious content. The site’s SSL certificate is issued by Let’s Encrypt (serial number E7), a common choice for phishing operators due to its free and automated issuance process. The page title, "Welcome to OpenResty!", suggests the use of a default or misconfigured web server, often seen in hastily deployed phishing kits. Security vendors have flagged this domain as malicious, with 9 of 95 engines on VirusTotal detecting it as phishing-related. Additionally, the domain appears on one security blocklist and is actively blocked by enterprise-level threat mitigation systems. As of the latest verification, t-mobile.sgepld.top remains active and continues to resolve. Users are strongly advised to avoid interacting with this domain or any subdomains. Organizations should implement DNS-level blocking for 172.67.204.220 and monitor for connections to this IP or domain in network logs. Individuals who may have entered credentials on this site should immediately reset passwords, enable multi-factor authentication, and review accounts for unauthorized activity. Security teams are encouraged to correlate this indicator with other phishing campaigns targeting telecommunications customers.