t-mobile[.]lxwcsf[.]top

PhishDestroy identifies a currently active credential theft domain actively impersonating the T-Mobile brand, specifically t-mobile.lxwcsf.top. This domain is classified as an elevated-risk threat and is actively engaged in malicious activity aimed at harvesting user credentials under the guise of the legitimate mobile carrier.
This domain was flagged by 13 of 95 VirusTotal security vendors, indicating significant but not universal detection coverage. The domain resolves to IP address 188.114.96.3 and is associated with a Let's Encrypt SSL certificate, increasing its appearance of legitimacy. Registered through NameSilo, LLC, the domain was created on May 13, 2026, and has already been listed on one security blocklist. Additionally, it has been blocked by OpenPhish, further validating its malicious nature. The domain's recent creation and active status suggest a rapidly evolving threat that requires immediate attention.
As of current intelligence, t-mobile.lxwcsf.top remains active and poses an elevated risk to users who may unknowingly interact with it. Organizations and individuals should block this domain at the network perimeter and educate users to avoid entering any credentials or sensitive information on this site. Immediate action includes updating DNS blocklists, reviewing firewall rules to block IP 188.114.96.3, and conducting user awareness training to prevent credential theft. Continuous monitoring of this domain and associated infrastructure is strongly advised due to its active status and the potential for further malicious campaigns.