t-mobile[.]bmyqr[.]top

This domain, t-mobile.bmyqr.top, poses a high-risk credential theft threat by impersonating T-Mobile’s official infrastructure. Analysis indicates the site was designed to harvest user login credentials through a fraudulent interface, likely leveraging social engineering tactics to deceive victims into entering sensitive account details. The presence of a legitimate-looking page title, 'Welcome to OpenResty!', suggests an attempt to mimic server responses, potentially increasing the perceived authenticity of the phishing attempt. Infrastructure analysis reveals the domain was registered on May 29, 2024, through NameSilo, LLC, a registrar frequently associated with malicious campaigns. It resolves to the IP address 104.21.94.131 and is flagged by 19 out of 95 security vendors on VirusTotal, with Google Safe Browsing specifically categorizing it as 'SOCIAL_ENGINEERING'. The domain appears on one security blocklist and employs Cloudflare and HTTP/3, which may obscure its true origin and complicate detection efforts. The creation date aligns with recent phishing trends targeting telecommunications providers. Users who visited t-mobile.bmyqr.top should immediately revoke any entered credentials, particularly T-Mobile account logins, and enable multi-factor authentication on all associated accounts. Device scans using updated security tools are recommended to detect potential secondary infections. If financial or personal data was submitted, affected individuals should monitor accounts for unauthorized activity and consider reporting the incident to relevant fraud response authorities. Network administrators are advised to block the domain and its resolving IP at the perimeter to prevent further exposure.