t-mobile[.]oxwtkb[.]top

This domain, t-mobile.oxwtkb.top, is identified as a credential harvesting phishing site designed to impersonate a telecommunications service login portal. Analysis indicates the site targets users by presenting a fraudulent interface to capture sensitive authentication details, including usernames, passwords, and potentially multi-factor authentication codes. The domain employs social engineering tactics, leveraging the recognizable branding of a major telecom provider to deceive visitors into submitting credentials under false pretenses. Infrastructure analysis reveals the domain was registered on May 17, 2026, through NameSilo, LLC, a registrar frequently associated with malicious domains due to its lenient registration policies. The domain resolves to the IP address 188.114.96.3 and is hosted behind Cloudflare, which provides obfuscation and resilience against takedowns. Detection metrics show the domain is flagged by 15 out of 95 security vendors on VirusTotal, while it appears on a single security blocklist. The page title, 'Welcome to OpenResty!', suggests the use of a default or misconfigured web server, a common indicator of hastily deployed phishing infrastructure. Additionally, the domain has a Gridinsoft trust score of 0/100, further confirming its malicious nature. Users who visited t-mobile.oxwtkb.top should immediately cease all interaction with the site and assume any credentials entered have been compromised. Affected individuals are advised to change passwords for all accounts where the same credentials may have been reused, prioritizing accounts associated with financial or sensitive personal data. Enabling multi-factor authentication on critical accounts can mitigate further risk. System administrators should block the domain and its associated IP (188.114.96.3) at the network level to prevent additional access. Monitoring for unauthorized transactions or account activity is strongly recommended, as compromised credentials may be exploited in subsequent attacks.