t-mobile[.]cdehln[.]top

PhishDestroy identifies t-mobile.cdehln.top as a live brand impersonation scam masquerading as T-Mobile to steal credentials or install crypto drainers. The impostor domain resolves to IP 188.114.96.3 and carries a Let’s Encrypt certificate, which can make it appear legitimate in browser bars. Victims who land here risk handing over T-Mobile login details or cryptocurrency wallet seed phrases to attackers without realizing the page is hostile. This domain was flagged after PhishDestroy correlated multiple threat-intel feeds and sandbox detections. It was created on May 13, 2024 through NameSilo, LLC and already shows up in VirusTotal reports from 9 of 95 participating antivirus engines. Its IP (188.114.96.3) and recent Let’s Encrypt certificate point to a low-cost, high-volume phishing operation designed to harvest credentials and siphon crypto in a single step. If you visited t-mobile.cdehln.top, assume your browser may have executed malicious JavaScript or prompted you for account details. Disconnect from the internet, run a full antivirus scan, and revoke any session cookies stored for T-Mobile or cryptocurrency services. Change T-Mobile and email passwords in a clean, offline environment, enable two-factor authentication wherever possible, and review wallet transactions for unauthorized transfers. Report the domain to your organization’s SOC or to PhishDestroy using report ID 708139 to help block further abuse.