t-mobile[.]wxvcai[.]top

This domain, t-mobile.wxvcai.top, was designed to trick visitors into believing they were on a legitimate T-Mobile website. The threat here is credential theft: attackers aimed to steal usernames, passwords, and possibly financial information by mimicking the T-Mobile login page. The site is now offline, but it posed a high risk to anyone who encountered it during its active period.

PhishDestroy identified this threat through multiple security signals. VirusTotal, a widely used threat intelligence platform, reported that 12 out of 95 security vendors flagged the domain as malicious. The domain was registered on May 29, 2026, through NameSilo,LLC, a registrar sometimes abused for phishing operations. It resolved to the IP address 188.114.97.3, which was also associated with other suspicious activity. Google Safe Browsing specifically labeled it as a phishing site, and it appeared on at least one security blocklist. Interestingly, the page title displayed "Welcome to OpenResty!" rather than anything T-Mobile branded, which is a common red flag for a misconfigured phishing page.

If you visited this site and entered any personal information, act immediately. Change your T-Mobile account password and any other accounts using the same credentials. Enable two-factor authentication on your accounts if available. Monitor your financial statements for unauthorized transactions and consider placing a fraud alert on your credit reports. For additional protection, run a full antivirus scan on your device to check for any malware that may have been downloaded. Remember that legitimate companies like T-Mobile never ask for sensitive information through unsolicited links. Always verify URLs carefully before entering login details.