t-mobile[.]sapgrj[.]top

This domain, t-mobile.sapgrj.top, is flagged as a confirmed phishing site impersonating T-Mobile’s login portal infrastructure. Analysis indicates the site presents a fraudulent authentication interface designed to harvest user credentials, likely targeting mobile subscribers under the guise of account verification or billing updates. No cryptocurrency drainer kit signatures were detected, but the presence of a generic phishing framework suggests credential theft as the primary objective. The domain mimics T-Mobile’s branding through subdomain structure and page layout, though no direct affiliation with the legitimate telecommunications provider exists. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 28, 2026, through NameSilo, LLC, a registrar frequently observed in phishing campaigns due to its low-cost registration and privacy protection services. It resolves to IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.), a network commonly used to mask origin servers and evade takedowns. The site lacks an SSL certificate, increasing the likelihood of interception or detection by security controls. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious, while it appears on one external blocklist. Google Safe Browsing does not currently list the domain, indicating a potential gap in detection coverage. As of the latest verification, t-mobile.sapgrj.top remains active and accessible, posing a continued risk to users. The lack of SSL encryption and the use of Cloudflare infrastructure suggest an attempt to balance operational security with accessibility. Organizations should update web filtering rules to block the domain and associated IP, while users are advised to verify URLs through official T-Mobile channels before entering credentials. Given the domain’s recent registration date and active status, further monitoring is recommended to track potential shifts in hosting or evasion tactics.