t-mobile[.]lxykjb[.]top

The domain t-mobile.lxykjb.top has been confirmed as a high-risk phishing site specifically designed to impersonate T-Mobile, a major telecommunications provider. Analysis indicates this infrastructure was actively harvesting user credentials through a fraudulent login portal, a tactic consistent with account takeover campaigns. The site is currently offline, though prior activity suggests it was operational for a limited window targeting unsuspecting customers. Infrastructure analysis reveals the domain was registered through NameSilo, LLC, with a creation date of May 28, 2024, indicating recent deployment. The domain resolves to the IP address 188.114.96.3, which is associated with content delivery network infrastructure, a common obfuscation technique to mask hosting origins. Detection metrics show the domain was flagged by 17 of 95 security vendors on VirusTotal, with Google Safe Browsing specifically categorizing it under SOCIAL_ENGINEERING. The page title, 'Welcome to OpenResty!', suggests the use of a reverse proxy or web server software, further aligning with phishing infrastructure patterns. The domain appears on one security blocklist, and additional telemetry confirms the presence of Cloudflare and HTTP/3, likely employed to evade detection and enhance performance. Current status indicates the domain has been taken offline, though the underlying infrastructure may remain dormant for future reuse. Organizations and individuals are advised to treat any prior interaction with this domain as compromised, particularly credentials entered during the active window. Network-level protections should be updated to include the observed IP address (188.114.96.3) and domain in blocklists. Users who may have engaged with this site are strongly recommended to reset passwords for associated accounts, enable multi-factor authentication, and monitor for unauthorized activity. Proactive monitoring of newly registered domains under similar naming conventions (e.g., brand + random subdomains) is advised to preempt future campaigns.