t-mobile[.]xjklba[.]top

This domain, t-mobile.xjklba.top, is flagged as a high-risk credential phishing site targeting T-Mobile customers. Analysis indicates it employs social engineering tactics to deceive users into submitting login credentials, likely funneling stolen data to a backend drainer kit. The page title, 'Welcome to OpenResty!', suggests the use of a misconfigured or obfuscated web server, a common trait in hastily deployed phishing infrastructure. Infrastructure analysis reveals the following technical indicators: the domain is detected by 13 out of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious nature. It was registered through NameSilo, LLC, on May 19, 2026, a future date that may indicate falsified registration details or a typo. The domain resolves to IP address 172.67.164.172, hosted by Cloudflare, Inc. in Canada, which is frequently leveraged to mask the true origin of malicious traffic. It appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious sites due to its free and automated issuance process. As of the latest assessment, t-mobile.xjklba.top remains active, posing an ongoing threat to users who may encounter it through phishing emails, SMS, or malvertising campaigns. Immediate response actions include blocking the domain at the DNS level, adding it to enterprise and consumer blocklists, and monitoring for related infrastructure. Despite these measures, the domain's use of Cloudflare hosting and a valid SSL certificate increases its perceived legitimacy, elevating the risk of successful credential theft. Users are advised to verify domain authenticity before entering sensitive information and to report any suspicious links to their security teams.