t-mobile[.]nwezrd[.]top

This domain is flagged as a high-risk credential theft operation targeting T-Mobile customers. Analysis indicates the infrastructure is designed to harvest login credentials through brand impersonation, a tactic commonly used to gain unauthorized access to accounts for fraudulent transactions or identity theft. The domain exhibits multiple technical indicators consistent with malicious activity, including a recent creation date and association with known phishing infrastructure. Infrastructure analysis reveals the domain t-mobile.nwezrd.top was registered on May 19, 2026, through NameSilo, LLC, a registrar frequently observed in phishing campaigns. It resolves to the IP address 188.114.97.3, hosted on CloudFlare infrastructure in Canada, which is often leveraged to obscure the true origin of malicious traffic. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for threat actors due to its ease of acquisition and short validity periods. Security vendors on VirusTotal flag this domain as malicious, with 12 out of 95 engines detecting it. The domain appears on one security blocklist, though it remains active and accessible in certain regions. The page title, 'Welcome to OpenResty!', suggests the use of a reverse proxy or web server configuration commonly exploited in phishing setups to evade detection. Mitigation steps for credential theft threats include immediate blocking of the domain and its associated IP address (188.114.97.3) at the network perimeter. Organizations should deploy email filtering rules to quarantine messages containing links to t-mobile.nwezrd.top or similar domains. End users should be advised to avoid entering credentials on any site that does not use the official T-Mobile domain (t-mobile.com) and to enable multi-factor authentication (MFA) on all accounts. Security teams are recommended to monitor for unusual login attempts or password reset requests, as these may indicate compromised credentials. Additionally, domain registrars and hosting providers should be notified of the malicious activity to facilitate takedown efforts.