tea[.]mdm[.]world

Analysis of the domain tea.mdm.world indicates an active credential-harvesting operation targeting enterprise users. Registered on May 8, 2026 through Sav.com, LLC, the domain resolves to 76.223.54.146, an address associated with AWS Global Accelerator infrastructure located in the United States. The absence of SSL certificates and the presence of empty MX records suggest minimal effort to establish legitimate email or secure communication channels, a common characteristic of phishing infrastructure designed for short-term exploitation. Infrastructure review reveals the domain is hosted on nameservers ns1.afternic.com and ns2.afternic.com, a configuration often observed in domains registered through secondary marketplaces. As of July 12, 2026, only one security vendor has flagged tea.mdm.world on detection platforms, while a single blocklist—PhishDestroy—has incorporated the domain into its filtering rules. The low detection rate does not indicate safety; rather, it reflects the domain's recent deployment and limited exposure. The domain remains operational, returning an HTTP 200 status, which confirms active hosting and potential interaction with visitors. The threat actor appears to be leveraging the 'mdm' subdomain to impersonate mobile device management portals, a tactic frequently employed to deceive employees into submitting corporate credentials. The use of AWS Global Accelerator infrastructure allows rapid content delivery and resilience against takedown attempts, complicating mitigation efforts. Defenders are advised to monitor network traffic for connections to 76.223.54.146 and to inspect any inbound links referencing tea.mdm.world. Given the domain's registration recency and the absence of historical reputation, automated detection systems may not yet recognize the threat, necessitating manual review of suspicious login pages and immediate reporting to security teams.