t-mobile[.]pdoluz[.]top

This domain, t-mobile.pdoluz.top, is identified as a high-risk credential theft operation targeting users through brand impersonation of T-Mobile. Analysis indicates the infrastructure was designed to deceive victims into submitting login credentials, payment details, or personal information under the guise of a legitimate telecommunications service. The page title, 'Welcome to OpenResty!', suggests the use of a reverse proxy or web server framework commonly exploited in phishing campaigns to obfuscate malicious intent. No direct evidence of a crypto drainer kit was observed, but the presence of Cloudflare and HTTP/3 technologies points to an attempt to evade detection and enhance operational resilience. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to the IP address 188.114.97.3, a Cloudflare-hosted endpoint often leveraged to mask origin servers and complicate takedown efforts. Registered on May 28, 2026, through NameSilo, LLC, the domain exhibits an anomalous creation date, likely manipulated to bypass automated detection systems that rely on domain age as a trust signal. Google Safe Browsing flags the domain with a 'SOCIAL_ENGINEERING' classification, while VirusTotal reports 15 out of 95 security vendors detecting malicious activity. The domain appears on one security blocklist, further corroborating its fraudulent nature. The domain is currently offline, indicating either a voluntary takedown by the threat actor or successful mitigation by hosting providers or security teams. However, residual risk persists due to the potential for rapid redeployment of similar infrastructure under new domains or subdomains. Organizations and users are advised to monitor for related indicators, including the IP address 188.114.97.3, the registrar NameSilo, and any domains resolving to the same Cloudflare endpoint. Immediate steps should include blocking the domain and IP at the network level, updating endpoint protection rules, and conducting internal audits for compromised credentials. Proactive threat hunting for associated artifacts, such as HTTP/3 traffic patterns or OpenResty server headers, is recommended to identify potential lateral movement or secondary infections.