t-mobile[.]nkvuh[.]icu

The domain t-mobile.nkvuh.icu has been identified as a brand impersonation phishing site that specifically targets users of X.com. Although the domain appears to mimic T-Mobile branding, its threat intelligence indicates it is designed to impersonate X.com and likely harvest login credentials or distribute malware. As of the latest check, the site has been taken offline, but users who may have visited it earlier should remain cautious.

Security analysis reveals that the domain was created on December 09, 2025, through registrar Gname.com Pte. Ltd., and resolved to IP address 188.114.96.3 with no SSL certificate present. VirusTotal flagged this domain by 16 out of 95 security vendors, and it currently appears on 2 security blocklists. PhishDestroy's own analysis confirms elevated risk, and the page title displayed was simply 'Welcome to nginx!', a common placeholder that often precedes malicious content.

Given that the site is now offline, the immediate threat is reduced, but users should avoid any links or emails referencing this domain. PhishDestroy recommends verifying all URLs through its verification tool before entering personal information, especially those claiming to be from X.com or T-Mobile. Stay vigilant and report any suspicious communications to security teams.