t-mobile[.]rwdjau[.]top

PhishDestroy has identified t-mobile.rwdjau.top as a high-risk domain engaged in brand impersonation of T-Mobile. This domain was created on May 15, 2026, and its page title, "Welcome to OpenResty!", is inconsistent with a legitimate T-Mobile site, suggesting it may have been used for credential harvesting or malware distribution. The domain is currently offline, but while active it posed a significant threat to unsuspecting users.

The technical indicators for this domain are alarming. VirusTotal reports that 18 out of 95 security vendors flag this domain as malicious, and Google Safe Browsing specifically lists it as phishing. The domain resolves to IP address 104.21.45.51 and was registered through NameSilo, LLC, with an SSL certificate issued by Let's Encrypt (serial E8). It also appears on one security blocklist. These details collectively paint a picture of a well-constructed phishing operation designed to mimic T-Mobile's legitimate online presence.

The domain's current status is offline, which may indicate that security teams have taken action to shut it down. However, the remaining risk is that users who previously interacted with it may have already compromised their credentials or financial information. PhishDestroy advises users who visited this domain to change their T-Mobile passwords immediately and monitor for any suspicious activity on their accounts. Always verify the authenticity of any site claiming to be T-Mobile by navigating directly to the official T-Mobile website rather than clicking on links in unsolicited messages.