t-mobile[.]oswybj[.]top

PhishDestroy identifiers have flagged the domain t-mobile.oswybj.top as an active credential theft page masquerading as T-Mobile’s official platform, using a generic phishing template to harvest user login details. The site leverages T-Mobile’s brand recognition to deceive visitors, with the malicious infrastructure hosted on 188.114.97.3 and secured via a Let’s Encrypt SSL certificate to appear legitimate. While no specific drainer kit payload has been publicly documented, the page’s purpose aligns with classic credential phishing, where stolen credentials are likely harvested for follow-on attacks including account takeover, SIM swapping, or financial fraud.

This domain, registered on May 07, 2026 through NameSilo, LLC, exhibits multiple red flags confirmed by independent threat intelligence sources. Google Safe Browsing has classified it under SOCIAL_ENGINEERING, and VirusTotal shows detection coverage by 8 out of 95 security vendors as of seed f8cde5. The infrastructure maps to IP 188.114.97.3, a known hosting node associated with low-reputation activity. The combination of a recently registered domain, high-risk categorization, and partial blocklisting indicates active malicious operations, though it has not yet achieved widespread dissemination.

The threat remains actively accessible and is currently unblocked by most enterprise defenses, posing an elevated risk of user compromise. Immediate action is advised: add t-mobile.oswybj.top and its resolving IP 188.114.97.3 to network blocklists, update browser and email security policies to flag the domain, and issue user advisories warning against interacting with unsolicited T-Mobile communications. Despite these measures, residual risk persists due to the domain’s recent creation and the dynamic nature of phishing campaigns. Continuous monitoring of this domain and similar patterns is strongly recommended to prevent credential theft and downstream attacks.