dg[.]mntbell[.]com

This domain, dg.mntbell.com, operates as a credential harvesting phishing portal targeting users of MTS Mail services. The site mimics the legitimate MTS Mail login interface, presenting a fraudulent authentication page titled 'MTS Mail | Login' to deceive visitors into submitting their account credentials. Analysis indicates the threat is designed to capture usernames, passwords, and potentially multifactor authentication codes, which are then likely exfiltrated to attacker-controlled infrastructure for unauthorized account access or subsequent exploitation in fraudulent activities. Technical indicators confirm the malicious nature of this domain. VirusTotal detection shows 23 out of 95 security vendors flagging dg.mntbell.com as malicious, with Google Safe Browsing specifically categorizing it under 'SOCIAL_ENGINEERING.' The domain was registered through Cloudflare, Inc. on March 02, 2026, an unusual future date suggesting potential domain spoofing or registry manipulation. It resolves to the IP address 104.21.26.234 and appears on at least one security blocklist. Infrastructure analysis reveals the use of Cloudflare services, IPFS for content storage, and technologies such as jQuery CDN, IPinfo, and HTTP/3, which are often leveraged to enhance phishing site functionality and evade detection. Users who visited dg.mntbell.com and entered credentials should immediately take corrective actions. First, change passwords for MTS Mail and any other accounts where identical or similar credentials may have been reused. Enable multifactor authentication if not already active, using app-based or hardware tokens rather than SMS-based methods. Monitor accounts for unauthorized activity, including logins from unfamiliar locations or devices, and review connected applications for suspicious third-party access. If financial or sensitive data was exposed, consider placing a fraud alert or credit freeze with relevant institutions. Network administrators should block the domain and its resolving IP (104.21.26.234) at the perimeter to prevent further access attempts.