t-mobile[.]kxgoni[.]top

This domain, t-mobile.kxgoni.top, poses as a legitimate T-Mobile portal to harvest user login credentials. Analysis indicates the site is designed to mimic authentication pages, tricking visitors into entering sensitive account details such as usernames, passwords, and potentially two-factor authentication codes. Once submitted, this information is transmitted to threat actors, enabling unauthorized access to victim accounts, financial fraud, or further targeted attacks. The risk is elevated due to the domain's convincing impersonation of a trusted telecommunications provider and its potential to compromise personal and corporate data. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain was registered on May 29, 2026, through NameSilo, LLC, a registrar frequently associated with phishing campaigns. It resolves to the IP address 172.67.150.80, hosted on Cloudflare's network (AS13335), which is commonly used to obfuscate attacker infrastructure. The absence of an SSL certificate further undermines user trust, as modern browsers flag such sites as insecure. Detection data from security vendors confirms the threat, with 22 out of 95 engines flagging the domain as malicious. Additionally, the domain appears on one security blocklist and is currently offline, likely due to takedown efforts. Individuals who visited t-mobile.kxgoni.top or entered credentials on the site should take immediate action to mitigate risks. First, reset passwords for T-Mobile accounts and any other services where the same credentials may have been reused. Enable multi-factor authentication (MFA) using app-based or hardware tokens, avoiding SMS-based methods if possible. Monitor account activity for unauthorized transactions or changes, and report suspicious behavior to the legitimate service provider. If financial information was entered, contact relevant institutions to secure accounts and consider placing fraud alerts. Finally, scan local devices for malware, as phishing sites may distribute additional payloads or redirect to exploit kits.