t-mobile[.]tmuwpk[.]top

This domain, t-mobile.tmuwpk.top, is actively engaged in brand impersonation phishing targeting T-Mobile customers. Analysis indicates the site presents a fraudulent login portal designed to harvest user credentials, including usernames, passwords, and potentially multi-factor authentication codes. The domain mimics legitimate T-Mobile branding, leveraging social engineering tactics to deceive visitors into entering sensitive account information. The absence of an SSL certificate further increases the risk of data interception during transmission, exposing users to account takeover and subsequent fraudulent activities such as unauthorized transactions or identity theft.

Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of this domain. The domain was registered on May 30, 2026, through NameSilo, LLC, an unusually future-dated creation that may indicate an attempt to evade detection or establish long-term phishing campaigns. VirusTotal reports 20 out of 95 security vendors flagging the domain as malicious, with a specific classification of generic phishing. The domain resolves to the IP address 172.67.201.9, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic used to conceal the true origin of phishing infrastructure. It appears on one security blocklist and is currently blocked by at least one major threat intelligence feed. The page title, 'Welcome to OpenResty!', suggests the use of default or misconfigured server software, a red flag often associated with hastily deployed phishing kits.

Users who have visited t-mobile.tmuwpk.top or entered credentials on the site should take immediate action to mitigate potential compromise. First, reset passwords for any accounts accessed or entered on the site, prioritizing T-Mobile and other high-value accounts such as email or financial services. Enable multi-factor authentication if not already active, using app-based or hardware tokens instead of SMS-based methods where possible. Monitor accounts for unauthorized activity, including login attempts, transactions, or changes to personal information. If financial data or payment details were entered, contact relevant institutions to report potential fraud and request account monitoring. Additionally, scan local devices for malware using updated security tools, as phishing sites may deploy malicious payloads or redirect to exploit kits. Report the domain to local cybersecurity authorities or the impersonated brand’s abuse team to aid in takedown efforts.