t-mobile[.]ecpqwm[.]top

This domain, t-mobile.ecpqwm.top, is flagged as a generic phishing site targeting T-Mobile users with the intent to steal account credentials. Analysis indicates the infrastructure mimics legitimate T-Mobile login portals, though no specific drainer kit signatures have been confirmed at this time. The page title, 'Welcome to OpenResty!', suggests the use of OpenResty web server software, which may be employed to obfuscate malicious activity or serve phishing content dynamically. Infrastructure analysis reveals the domain was registered on May 31, 2026, through NameSilo, LLC, an unusually future-dated creation that may indicate an attempt to evade reputation-based detection systems. It resolves to IP address 172.67.213.99, hosted on AS13335 (Cloudflare, Inc.), a common proxy service leveraged to conceal the true origin of malicious traffic. VirusTotal detection shows 21 out of 95 security vendors have flagged the domain as malicious. The domain appears on one security blocklist and currently lacks an SSL certificate, increasing the likelihood of interception or tampering during credential transmission. As of the latest assessment, t-mobile.ecpqwm.top remains active and unresolved by the registrar or hosting provider. No takedown requests have been observed, and the domain continues to serve phishing content. The risk level is classified as high due to the combination of brand impersonation, lack of encryption, and confirmed malicious detections. Organizations and users are advised to block the domain at the DNS or firewall level and monitor for credential reuse attempts. Security teams should treat any interaction with this domain as a potential compromise and initiate password resets for affected accounts.