t-mobile[.]shuzwx[.]top

Analysis of the domain t-mobile.shuzwx.top shows a newly registered infrastructure that is currently being leveraged for a generic phishing campaign. The domain was created on May 20, 2026 and is registered through NameSilo, LLC. Its authoritative name servers are kyree.ns.cloudflare.com and meilani.ns.cloudflare.com, indicating the use of Cloudflare’s DNS services. The domain resolves to the IP address 188.114.96.3, an address belonging to Cloudflare’s global edge network, which is commonly employed to provide anonymity and resilience for malicious actors.

The domain is already listed on one security blocklist and has been flagged by the PhishDestroy sinkhole, confirming active exploitation. VirusTotal reports that 17 of 91 security vendors have marked the domain as malicious, reinforcing the assessment that it is part of an ongoing phishing operation. While the precise content of the hosted page, SSL certificate details, and HTTP response codes have not been disclosed, the available evidence is sufficient to classify the domain as high‑risk for credential harvesting.

Defenders should immediately block DNS resolution for t-mobile.shuzwx.top at the network perimeter, add the IP 188.114.96.3 to outbound deny lists, and ensure email security gateways are configured to quarantine messages containing links to this domain. Continuous monitoring of Cloudflare‑associated IP ranges for similar patterns is advised, as the attacker may shift hosting to adjacent edge nodes. Organizations should also update threat intelligence feeds with the registrar, creation date, and blocklist identifiers to improve detection of any future variants that reuse the same registration profile.