t-mobile[.]xpcajq[.]top

This domain, t-mobile.xpcajq.top, is flagged as a credential phishing site specifically targeting T-Mobile customers. Analysis indicates the infrastructure was designed to mimic legitimate T-Mobile login portals, likely to harvest user credentials and personal data. The page title 'Welcome to OpenResty!' suggests the use of a lightweight web server framework, often employed in phishing kits for its ease of deployment and low detection rates. No specific drainer kit signatures were identified, but the domain aligns with common phishing tactics observed in mobile carrier impersonation schemes. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.67.168.158, a Cloudflare-hosted endpoint, which may have been leveraged to obfuscate the true origin of the phishing server. It was registered through NameSilo, LLC, on May 19, 2026, an unusually future-dated creation that may indicate domain generation algorithm (DGA) misuse or registry manipulation. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is currently classified as offline. Cloudflare Browser Insights and HTTP/3 were detected, suggesting the use of modern web technologies to enhance performance and evade detection. The domain has been taken offline, likely due to automated takedown mechanisms or registrar intervention. However, residual risk remains due to the potential reuse of the underlying infrastructure or registration patterns. Users who may have interacted with the domain are advised to reset credentials immediately, enable multi-factor authentication, and monitor accounts for unauthorized activity. Organizations should update blocklists to include the domain and IP, and investigate any related indicators of compromise within their networks. The future-dated registration warrants further scrutiny to determine if additional domains using similar patterns exist.