t-mobile[.]ogmysr[.]top

This domain, t-mobile.ogmysr.top, operates as a credential harvesting phishing site designed to deceive visitors into submitting sensitive login information. The site mimics legitimate mobile carrier portals, presenting a fraudulent interface that captures usernames, passwords, and potentially multi-factor authentication codes. Analysis indicates the domain specifically targets users of mobile services, exploiting brand recognition to increase the likelihood of successful phishing attempts. The absence of an SSL certificate further elevates the risk, as data transmitted to the site is unencrypted and vulnerable to interception. Infrastructure analysis reveals the domain was registered on May 29, 2024, through NameSilo, LLC, and remains active as of this report. It resolves to the IP address 188.114.97.3, hosted under AS13335 (Cloudflare, Inc.), a common tactic to obscure the true origin of malicious traffic. Detection metrics confirm the domain’s malicious nature: 23 out of 95 security vendors on VirusTotal flag it as phishing, while Google Safe Browsing and a separate blocklist (PhishDestroy) have also issued warnings. The page title, 'Welcome to OpenResty!', suggests the use of a web server framework often employed in low-effort phishing deployments, further indicating its illegitimate purpose. Users who have visited t-mobile.ogmysr.top or entered credentials on the site should take immediate action to mitigate potential compromise. First, reset all passwords associated with the targeted account, prioritizing credentials used for financial or sensitive services. Enable multi-factor authentication on all accounts where available, using app-based or hardware tokens rather than SMS-based methods. Monitor the affected account and linked services for unauthorized activity, including unusual login attempts or changes to account settings. If financial information was entered, contact the relevant institution to report potential fraud. Finally, scan the device used to access the site for malware, as phishing pages may deploy additional payloads to maintain persistence or exfiltrate data.