t-mobile[.]swmzre[.]top

PhishDestroy identifies t-mobile.swmzre.top as a fraudulent spoof of the legitimate T-Mobile login portal designed to harvest user credentials. This domain belongs to the generic phishing category and is actively used to deceive visitors into submitting sensitive information under the guise of T-Mobile authentication. No specialized crypto drainer kit was detected during the investigation, indicating the primary intent is identity theft rather than direct cryptocurrency theft. This domain was flagged by 8 out of 95 VirusTotal security vendors and resolved to IP address 172.67.196.242. It was registered through NameSilo, LLC using a Let's Encrypt SSL certificate, and first observed on May 10, 2026. As of this report, the domain remains unlisted on Google Safe Browsing (GSB) and has not yet propagated across major threat intelligence blocklists, which increases its potential reach to unsuspecting users seeking T-Mobile services. The domain is currently active and poses an elevated risk due to its deceptive branding and low detection rate. PhishDestroy has issued a real-time block and continues to monitor for related infrastructure. While immediate exposure is contained, users should remain cautious, avoid entering credentials, and rely on verified T-Mobile domains or PhishDestroy’s URL validator for safe access.