t-mobile[.]nweshu[.]top

This domain, t-mobile.nweshu.top, is identified as a high-risk phishing resource impersonating T-Mobile, a major telecommunications provider. Analysis indicates the site presents a fraudulent login portal designed to harvest user credentials, likely targeting mobile subscribers under the guise of account verification or billing updates. No evidence of a cryptocurrency drainer or payment skimmer was observed in initial scans, though the presence of a generic OpenResty page title suggests minimal effort to conceal the underlying infrastructure. Infrastructure analysis reveals the domain was registered on May 30, 2026, through NameSilo, LLC, a registrar frequently associated with abusive registrations. The domain resolves to IP address 104.21.82.210, hosted on AS13335 (Cloudflare, Inc.), a network commonly exploited for bulletproof hosting due to its privacy protections. As of the latest assessment, the domain lacks an SSL certificate, further reducing its legitimacy. Detection metrics show 21 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on a single security blocklist. Google Safe Browsing (GSB) has not yet listed the domain, indicating a potential gap in automated detection coverage. The domain remains active as of the latest verification, with no takedown or suspension observed. Response actions by hosting providers or registrars have not been confirmed, leaving the infrastructure intact. The remaining risk is classified as high due to the domain's operational status, brand impersonation, and credential harvesting intent. Users are advised to avoid interacting with the domain, verify URLs through official channels, and report suspicious login prompts to the impersonated brand's security team. Network administrators should block the IP and domain at the perimeter to prevent access from internal systems.