xm[.]wttee[.]my[.]id

This domain, xm.wttee.my.id, is identified as a generic phishing resource designed to mimic account suspension or verification prompts, as indicated by its 'Link Web Expired' page title. Analysis suggests the domain was crafted to deceive users into submitting login credentials or other sensitive information under the pretense of resolving an expired or suspended account. No specific brand impersonation has been confirmed, though the lure aligns with common credential harvesting tactics observed in phishing campaigns targeting web-based services. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. and resolves to the IP address 172.67.212.138, hosted under AS13335 (Cloudflare, Inc.) in the United States. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is flagged by 11 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing domains to appear legitimate. No creation date or Google Safe Browsing (GSB) status is available for this domain, limiting temporal analysis. The domain is currently offline, likely due to takedown actions or suspension by the registrar. While the immediate threat has been mitigated, the infrastructure remains a potential risk for future abuse. Users who may have interacted with this domain are advised to reset credentials for any accounts accessed during the exposure window. Organizations should monitor for similar domains leveraging Cloudflare-hosted infrastructure and expired-link lures, as this tactic remains prevalent in credential theft campaigns.