t-mobile[.]mpuyjd[.]top

This domain, t-mobile.mpuyjd.top, is actively impersonating T-Mobile with the intent of credential theft. Analysis indicates the infrastructure is designed to mimic legitimate T-Mobile login portals, likely harvesting user credentials through deceptive input forms. The page title, Welcome to OpenResty, suggests the use of a reverse proxy server commonly exploited in phishing campaigns to obscure backend infrastructure. No direct evidence of a crypto drainer kit or payment skimming was observed, but the credential theft focus aligns with broader trends in telecommunications fraud. Infrastructure analysis reveals multiple high-risk indicators. The domain resolves to IP address 188.114.96.3, geolocated to Canada under Cloudflare, Inc., a provider frequently abused for anonymization. It was registered on May 16, 2026, through NameSilo, LLC, with a suspiciously future creation date that may indicate domain spoofing or backdating. The SSL certificate is issued by Let's Encrypt (serial E7), a legitimate but often misused authority in phishing operations. VirusTotal detection shows 9 out of 95 security vendors flagging the domain, while it appears on one security blocklist. The domain is not currently listed in Google Safe Browsing databases, which may delay user warnings. The domain remains active as of this assessment, posing a persistent risk to users. Response actions should include immediate blacklisting by network security providers, revocation of the SSL certificate, and takedown requests to the registrar and hosting provider. Remaining risk includes potential credential reuse across other platforms and secondary attacks leveraging stolen T-Mobile accounts. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication on all accounts, and report suspicious login pages to their telecommunications provider. Network administrators should monitor for connections to 188.114.96.3 and related subdomains under mpuyjd.top.