t-mobile[.]sqiton[.]top

This domain, t-mobile.sqiton.top, is actively impersonating a telecommunications provider login portal to harvest user credentials. Analysis indicates the site presents a fraudulent authentication interface designed to mimic legitimate customer portals, targeting users with the intent to capture login details, personal information, and potentially facilitate account takeovers. The domain employs brand impersonation tactics, leveraging the recognizable name of a major carrier to deceive victims into entering sensitive data under false pretenses. No secondary payloads or malware distribution have been observed at this time, but credential theft remains the primary objective. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on May 28, 2026, through NameSilo, LLC, a registrar frequently associated with malicious registrations. It resolves to the IP address 188.114.97.3, hosted on AS13355 (Cloudflare, Inc.), a network commonly exploited for bulletproof hosting due to its resilience and anonymization capabilities. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious, with detections spanning phishing, brand impersonation, and fraud categories. The domain appears on at least one security blocklist, and no valid SSL certificate is present, further degrading its legitimacy. The page title, 'Welcome to OpenResty!', suggests the use of a default or misconfigured web server, a common red flag in phishing infrastructure. Users who have visited t-mobile.sqiton.top or entered credentials on the site should assume compromise. Immediate actions include resetting passwords for the impersonated service and any other accounts where identical or similar credentials may have been reused. Enable multi-factor authentication on all critical accounts to mitigate unauthorized access. Monitor financial and communication accounts for suspicious activity, as stolen credentials may be exploited for further fraud. If personal or payment information was submitted, consider placing a fraud alert or credit freeze with relevant bureaus. Network administrators should block the domain and its resolving IP (188.114.97.3) at the perimeter to prevent further exposure. No legitimate traffic is expected from this domain; all interactions should be treated as malicious.