t-mobile[.]lwdupz[.]top

This domain, t-mobile.lwdupz.top, is flagged as a high-risk phishing portal targeting T-Mobile customers. Analysis indicates the site is designed to impersonate the official T-Mobile login interface, likely deploying credential harvesting and payment skimming techniques to capture sensitive user data. The presence of a generic OpenResty welcome page suggests either an incomplete deployment or an attempt to mask the true nature of the malicious infrastructure before full activation. Infrastructure analysis reveals concrete technical indicators of compromise. The domain was registered on May 16, 2026, through NameSilo, LLC, an uncommon future date that may indicate fraudulent registration practices. It resolves to IP address 188.114.96.3, hosted on Cloudflare infrastructure in Canada, which is frequently abused for phishing campaigns due to its anonymity and resilience. The domain is flagged by 16 out of 95 security vendors on VirusTotal, appears on one security blocklist, and is actively blocked by PhishDestroy. The SSL certificate, issued by Let's Encrypt (serial E7), provides HTTPS encryption but does not validate legitimacy, as phishing sites commonly exploit free certificates to appear trustworthy. As of the latest assessment, t-mobile.lwdupz.top remains active and operational, posing an ongoing threat to users. The domain has not been added to Google Safe Browsing at this time, increasing the risk of undetected exposure. Response actions should include immediate blacklisting at the network level, revocation of the SSL certificate, and takedown requests to the registrar and hosting provider. Users are advised to avoid interacting with the domain, verify website authenticity through official channels, and monitor accounts for unauthorized activity. The remaining risk is classified as high due to the domain's active status, credible impersonation of a major telecommunications brand, and lack of widespread detection across security platforms.