t-mobile[.]jloqwn[.]top

PhishDestroy identifies t-mobile.jloqwn.top as an active T-Mobile phishing domain designed to harvest user credentials through spoofed login pages. The domain leverages a lookalike subdomain structure to impersonate T-Mobile’s official website, aiming to trick victims into entering sensitive login details. This is not a generic phishing attempt but a targeted brand impersonation scam with elevated risk due to its deceptive presentation and active infrastructure.

This domain was flagged by 6 out of 95 VirusTotal security vendors, indicating widespread detection as malicious. It resolves to IP address 104.21.13.144 and is registered through NameSilo, LLC. The domain was created on May 08, 2026, and secured with a Let's Encrypt SSL certificate to appear legitimate. No known blocklist avoidance techniques were observed at the time of analysis, and the domain’s age suggests a recently deployed campaign with high operational activity.

Currently, t-mobile.jloqwn.top remains active and accessible, posing an ongoing threat to unsuspecting users. Immediate actions include blocking the domain at the network level, blacklisting the IP 104.21.13.144, and removing the SSL certificate to neutralize its appearance of authenticity. Despite these mitigations, the risk remains elevated due to the domain’s recent creation and the persistent nature of phishing campaigns. Users should avoid interacting with this domain entirely and report any encounters to their security teams or relevant abuse channels.