t-mobile[.]wetyfb[.]top

This domain, t-mobile.wetyfb.top, is identified as a credential harvesting phishing site designed to mimic legitimate mobile service provider portals. Analysis indicates the domain was constructed to deceive users into submitting sensitive account credentials, including usernames, passwords, and potentially multi-factor authentication codes. The site employs social engineering tactics, such as spoofed login interfaces and urgency-driven messaging, to exploit user trust in branded communications. Given the domain’s targeting of mobile subscribers, the risk of credential compromise and subsequent unauthorized account access is elevated, particularly for users unaware of phishing indicators. Infrastructure analysis reveals the domain was registered on May 18, 2026, through NameSilo, LLC, and currently resolves to the IP address 104.21.7.3. It is hosted behind Cloudflare, utilizing technologies such as Cloudflare Browser Insights and HTTP/3, which may obscure its true origin and complicate takedown efforts. The domain appears on one security blocklist and has been flagged by 11 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The page title, 'Welcome to OpenResty!', suggests the use of a reverse proxy or misconfigured server, a common trait in hastily deployed phishing infrastructure. The domain was subsequently taken offline, though historical DNS records and cached content may still pose residual risks. Users who visited t-mobile.wetyfb.top or entered credentials on the site should immediately take corrective action. Reset passwords for any accounts accessed via the phishing page, prioritizing accounts linked to financial services or sensitive data. Enable multi-factor authentication where available, using app-based or hardware tokens instead of SMS-based methods, which may be vulnerable to interception. Monitor associated accounts for unauthorized activity, including login attempts, transactions, or changes to account settings. If payment details or personal identification information were submitted, consider placing a fraud alert with relevant credit bureaus. Organizations should review logs for connections to the domain or its resolving IP (104.21.7.3) and assess whether additional internal controls, such as email filtering or endpoint protection updates, are required to prevent similar incidents.