t-mobile[.]mjwplk[.]top

The domain t-mobile.mjwplk.top, which has been taken down, was used in a phishing campaign targeting T-Mobile customers. It was flagged by 17 out of 91 vendors on VirusTotal, indicating significant malicious activity. The domain was registered through NameSilo, LLC and hosted on an IP address associated with Cloudflare, Inc., located in the US.

Despite its current offline status, the domain had a relatively high platform risk score of 73/100. This score reflects its potential to cause harm during its active period. The site was initially detected by PhishDestroy on June 20, 2026, shortly after its creation on May 7, 2026. The quick detection highlights the effectiveness of PhishDestroy's monitoring systems in identifying threats during their early stages.

The domain was also listed on two public blocklists, PhishDestroy and OpenPhish, further corroborating its malicious intent. The SSL certificate was issued by Let's Encrypt, a common choice for phishing sites due to its ease of access and cost-free nature. The page title "Welcome to OpenResty!" suggests a default server setup, often seen in hastily assembled phishing sites. This case underscores the importance of maintaining robust security measures to protect against evolving phishing tactics.