t-mobile[.]yokar[.]icu

The domain t-mobile.yokar.icu was registered on December 07, 2025 through Gname.com Pte. Ltd. and resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The authoritative nameservers listed for the domain are macy.ns.cloudflare.com and sage.ns.cloudflare.com, confirming the use of Cloudflare's DNS infrastructure. No TLS certificate is presented; HTTP requests are answered by a generic nginx server that returns the page title "Welcome to nginx!". The site has been classified as a brand‑impersonation campaign targeting the brand x.com, and it appears on a single security blocklist.

VirusTotal analysis shows that 14 out of 95 security vendors have flagged the domain as malicious. Additional detection comes from Gridinsoft, which assigns a trust score of 0 out of 100, and the domain is actively blocked by the PhishDestroy service. The current operational status is offline, suggesting that the phishing infrastructure has been taken down or is no longer serving content.

While the available evidence confirms the domain’s malicious intent, details such as the specific phishing kit, content served, or victim interaction remain unknown because the site is not reachable for direct inspection. Defenders should continue to block the domain at network perimeter devices, update DNS filtering rules to include the associated IP range, and monitor for any resurgence of activity on the same infrastructure. Continuous observation of Cloudflare‑hosted IPs linked to this domain is advised, as threat actors may repurpose the same hosting assets for future impersonation campaigns.