t-mobile[.]rknbi[.]icu

Analysis of t-mobile.rknbi.icu, observed as offline as of 23 July 2026, shows infrastructure consistent with a brand‑impersonation campaign targeting Apple users. The domain was registered on 21 February 2026 and resolves to IP 188.114.97.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The hosting provider is a well‑known CDN service, a common choice for fast‑flux or disposable phishing sites. The site presented the page title “T‑Mobile Tuesdays - Get Free Stuff & Great Deals | T‑Mobile”, a legitimate‑looking title that may be used to lure victims through email or social‑media vectors. No visual content has been captured, and the page’s HTML has not been released, so the exact phishing or credential‑harvesting mechanisms remain unknown.

Detection data indicate mixed vendor response: 12 of 93 VirusTotal scanners flagged the domain, suggesting that a subset of commercial detection engines have signatures or heuristics that match the observed artifacts. Gridinsoft assigned a trust score of 0 out of 100, and the domain is listed on at least one public blocklist. It has also been added to the PhishDestroy feed, confirming that community‑driven defences have identified it as malicious. The SSL certificate is labeled “WE1”, which does not correspond to a publicly trusted CA, further lowering confidence in the site’s legitimacy. The campaign is categorized as a “Tech Support Scam” and is reported to impersonate Apple, although the page title references T‑Mobile.

This discrepancy may indicate a multi‑brand lure strategy, where the domain name and certificate are used to suggest T‑Mobile affiliation while the social‑engineering payload targets Apple customers seeking technical assistance. Because the site is currently offline, active exploitation cannot be confirmed, but the combination of low trust scores, vendor detections, and blocklist presence warrants a high‑confidence classification as a malicious impersonation site.