t-mobile[.]zctkrs[.]top

This domain, t-mobile.zctkrs.top, is identified as a high-risk phishing site specifically designed to impersonate T-Mobile payment portals. Analysis indicates the threat type is brand impersonation with a focus on fraudulent payment collection, targeting users attempting to settle mobile service bills. The domain remains active as of the latest verification, posing an ongoing risk to unsuspecting visitors. Infrastructure analysis reveals the domain has been flagged by 20 of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence platforms. The domain appears on at least one security blocklist, and its page title, t-mobile.zctkrs.top/pay/, explicitly suggests a fraudulent payment page. The registrar details and IP address associated with this domain remain undisclosed in available threat intelligence, though its creation date is recent, minimizing historical reputation data. No legitimate trust scores or prior benign usage have been recorded for this domain. Current status confirms the domain is still active and operational, continuing to host the deceptive payment portal. Users are strongly advised to avoid interaction with this domain and any associated links. Organizations should implement immediate blocking at the DNS or proxy level to prevent access. Individuals who may have entered credentials or payment details on this site should assume compromise, initiate password resets for affected accounts, and monitor financial statements for unauthorized transactions. Security teams are recommended to correlate this domain with other T-Mobile-themed phishing campaigns for broader threat hunting.