t-mobile[.]datuws[.]top

This domain, t-mobile.datuws.top, operates as a credential harvesting phishing site designed to deceive users into submitting sensitive login information. The site mimics legitimate telecommunications portals, presenting a fabricated interface to trick visitors into entering account credentials, which are then captured by threat actors for unauthorized access or financial fraud. Analysis indicates the site employs social engineering tactics, as evidenced by its inclusion in Google Safe Browsing's SOCIAL_ENGINEERING category, further confirming its malicious intent. Infrastructure analysis reveals the domain was registered on May 29, 2026, through NameSilo, LLC, a registrar frequently associated with abuse reports. The site resolves to the IP address 104.21.85.91 and is protected by Cloudflare, a common evasion tactic to obscure hosting details and complicate takedown efforts. Detection metrics show 13 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on at least one additional security blocklist. The page title, 'Welcome to OpenResty!', suggests the use of a reverse proxy or web server framework, which may be leveraged to obfuscate the true nature of the phishing content. Users who visited t-mobile.datuws.top should immediately take corrective action to mitigate potential compromise. First, reset any credentials entered on the site, prioritizing accounts linked to financial services or personal data. Enable multi-factor authentication on all critical accounts to prevent unauthorized access, even if credentials were exposed. Monitor associated accounts for suspicious activity, such as unauthorized transactions or login attempts from unfamiliar locations. If the site was accessed via a corporate or institutional device, report the incident to the relevant security team to facilitate broader threat containment and analysis.