t-mobile[.]mctsqk[.]top

This domain, t-mobile.mctsqk.top, is identified as a generic phishing infrastructure designed to impersonate T-Mobile login portals. Analysis indicates the site likely aims to harvest user credentials, payment details, or personal information through deceptive login forms. The page title 'Welcome to OpenResty!' suggests the use of a default OpenResty web server configuration, which is often exploited in phishing deployments due to its lightweight and customizable nature. No drainer kit signatures or cryptocurrency wallet addresses were observed in the available data, but the domain's structure and naming convention align with credential theft campaigns targeting mobile service subscribers.

Technical indicators confirm elevated risk: the domain is flagged by 9 out of 95 security vendors on VirusTotal, including detections for phishing and malicious web content. It was registered through NameSilo, LLC on May 20, 2026, with an anomalous future creation date that may indicate domain age manipulation or data entry error. The domain resolves to IP address 188.114.97.3, which has been associated with other phishing infrastructure in recent months. No SSL certificate is present, increasing the likelihood of interception during credential transmission. The domain appears on one security blocklist and is not currently listed in Google Safe Browsing (GSB) at the time of analysis, though this may reflect detection latency rather than benign status.

As of the latest verification, t-mobile.mctsqk.top has been taken offline, likely in response to abuse reports or automated takedown mechanisms. However, the underlying infrastructure remains a residual risk. The IP address and registrar may still host or facilitate other phishing domains, and the threat actor could redeploy the domain or migrate to similar infrastructure. Users who accessed the site prior to takedown should assume credential compromise and initiate password resets, particularly for T-Mobile accounts or any services where identical credentials were reused. Organizations should monitor network logs for connections to 188.114.97.3 and implement domain-based blocking for mctsqk.top and related subdomains as a precautionary measure.