t-mobile[.]natcek[.]top

The domain t-mobile.natcek.top has been identified as a phishing site specifically designed to impersonate T-Mobile, a major telecommunications provider. Analysis indicates this infrastructure is engineered for credential theft and social engineering attacks targeting mobile subscribers. The domain is currently offline, though prior activity suggests it was actively harvesting user login credentials and personal data under the guise of legitimate T-Mobile services. Infrastructure analysis reveals the domain was registered through NameSilo, LLC on June 16, 2026, an unusually future-dated creation timestamp that may indicate domain generation algorithm abuse or registry manipulation. The domain resolves to the IP address 188.114.96.3 and is flagged by 13 of 95 security vendors on VirusTotal, with Google Safe Browsing categorizing it under SOCIAL_ENGINEERING. The page title, Welcome to OpenResty!, suggests the use of a reverse proxy or web server framework commonly repurposed for phishing kit deployment. The domain appears on one security blocklist, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing its high-risk classification. Current status indicates the domain has been taken offline, likely in response to detection and mitigation efforts. However, the underlying infrastructure may remain active or be repurposed for future campaigns. Organizations and users are advised to block the domain and associated IP address at the network perimeter. Security teams should monitor for similar domains registered through the same registrar or resolving to the same IP range. End users who may have interacted with this domain should immediately reset credentials for T-Mobile accounts and enable multi-factor authentication where available. Network logs should be reviewed for connections to 188.114.96.3 or requests to t-mobile.natcek.top to identify potential compromise.