t-mobile[.]uhidsx[.]top

This domain, t-mobile.uhidsx.top, is identified as a credential theft operation specifically designed to impersonate T-Mobile’s legitimate infrastructure. Analysis indicates the site presents a fraudulent login interface or redirect mechanism to harvest user credentials, including usernames, passwords, and potentially multi-factor authentication codes. The use of a subdomain mimicking T-Mobile’s branding (t-mobile.uhidsx.top) is a common tactic to exploit trust in the targeted brand, increasing the likelihood of successful credential compromise. The presence of a generic OpenResty welcome page suggests either an incomplete deployment or a placeholder used to evade initial detection while the full malicious payload is prepared or rotated. Evidence supporting the malicious classification includes detection by 16 out of 95 security vendors on VirusTotal, indicating broad consensus on its harmful nature. The domain was registered on May 28, 2026, through NameSilo, LLC, a registrar frequently associated with abusive registrations due to its low-cost and minimal verification requirements. Infrastructure analysis reveals the domain resolves to the IP address 172.67.183.220, which is part of Cloudflare’s network, a service often leveraged to obfuscate the true origin of malicious traffic. Additionally, the domain appears on one security blocklist, and its use of HTTP/3 and Cloudflare Browser Insights suggests an attempt to mimic legitimate web properties while evading traditional detection mechanisms. The domain is currently offline, but this status may change if the threat actors redeploy the infrastructure. Users who visited t-mobile.uhidsx.top should assume their credentials or other sensitive information may have been compromised. Immediate actions include resetting passwords for any accounts accessed after visiting the domain, particularly those associated with T-Mobile or other telecommunications services. Enable multi-factor authentication on all critical accounts, using app-based or hardware tokens rather than SMS-based methods, which may also be targeted. Monitor financial and account activity for unauthorized transactions or changes, and review connected devices or sessions for signs of compromise. If login credentials were entered, consider revoking active sessions and notifying the affected service provider. Organizations should update internal blocklists to include this domain and its associated IP address to prevent future access.