t-mobile[.]wmpczx[.]top

This domain, t-mobile.wmpczx.top, is actively engaged in brand impersonation phishing targeting T-Mobile customers. Analysis confirms the site is operational, presenting fraudulent login interfaces to harvest credentials under the guise of the legitimate telecommunications provider. The domain remains accessible as of the latest verification, posing a direct risk to users who may mistake it for an official T-Mobile portal. Infrastructure analysis reveals the domain was registered on May 19, 2026, through NameSilo, LLC, a registrar frequently observed in phishing campaigns. It resolves to the IP address 104.21.43.145, geolocated to Cloudflare, Inc. in Canada, a common tactic to obscure hosting origins. The domain is flagged by 13 of 95 security vendors on VirusTotal, with one active security blocklist entry. The SSL certificate, issued by Let's Encrypt (serial number E7), provides a false sense of security while facilitating encrypted data exfiltration. The page title, 'Welcome to OpenResty!', suggests the use of a reverse proxy or web server framework often exploited in phishing deployments. Current status indicates the domain is still active and capable of harvesting sensitive information. Organizations and individuals are advised to block the domain and its resolving IP at the network level. End users should verify the legitimacy of any T-Mobile-related communication by accessing the official website directly via bookmarked or manually entered URLs. Security teams are recommended to monitor for additional domains registered under the same infrastructure, particularly those using similar subdomain patterns or registered through NameSilo. The high-risk classification is based on the confirmed impersonation of a major brand, active status, and detection by multiple security vendors.