t-mobile[.]slpih[.]icu

The domain t-mobile.slpih.icu was registered on December 13, 2025 through Gname.com Pte. Ltd. and is hosted on Cloudflare’s network (AS13335) with the IP address 104.21.10.47, which geolocates to the United States. DNS resolution points to two Cloudflare nameservers, aaden.ns.cloudflare.com and malavika.ns.cloudflare.com. No SSL certificate is presented, and an HTTP request returns the generic page title "Welcome to nginx!" indicating that the web server is serving a default Nginx landing page rather than a site that visibly mimics the targeted brand. The domain is classified as a brand‑impersonation campaign targeting x.com, and the scam type is explicitly listed as "Brand Impersonation".

Detection services have flagged the domain: 13 of 95 security vendors on VirusTotal report it as malicious, and it appears on at least one external blocklist. The site has been taken offline and is currently blocked by PhishDestroy. Independent reputation scoring assigns a Gridinsoft trust score of 0 out of 100, reinforcing the malicious assessment.

While the limited page title suggests no active phishing login page is currently served, the infrastructure and vendor detections indicate that the domain was prepared for credential harvesting or other brand‑spoofing activities. Defenders should continue to block the domain at perimeter filters, add the associated IP address to deny lists, and monitor for any resurgence of the host under different subdomains. Incident responders should also flag any email or URL references to t-mobile.slpih.icu as malicious and advise users to avoid clicking links that claim to originate from x.com but point to this domain.