t-mobile[.]kuiht[.]icu

Analysis indicates that the domain t-mobile.kuiht.icu was registered on 21 February 2026 and is currently taken offline. DNS resolution points to the address 172.67.154.178, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The HTTP response returns the default nginx page with the title "Welcome to nginx!", and the TLS certificate is identified as "WE1", offering no brand‑specific validation. The domain is explicitly listed as a brand‑impersonation campaign targeting x.com, and security‑vendor scans on VirusTotal show that 10 of 95 engines flag the host as malicious.

Independent reputation services assign extremely low scores: Gridinsoft rates the site 0 / 100 and Scamadviser 1 / 100, indicating a near‑certain malicious intent. The domain appears on a single security blocklist and has been blocked by the PhishDestroy service, confirming that defensive circles have already taken action against it. The observable infrastructure suggests a typical abuse pattern: rapid registration, use of a shared Cloudflare front‑end, and deployment of a generic web server banner rather than a tailored phishing page. Because the site is offline, content‑level indicators such as credential‑stealing forms or brand assets cannot be confirmed, leaving the exact delivery mechanism uncertain.

Nonetheless, the combination of brand‑impersonation labeling, multiple vendor detections, and the very low trust scores provides strong evidence that the domain was created for malicious purposes. Defenders should continue to block the IP address 172.67.154.178 for traffic associated with t-mobile.kuiht.icu, add the domain to URL filtering and email‑security policies, and monitor for any future re‑registration or similar sub‑domains that resolve to the same Cloudflare network. Continuous re‑scanning on multi‑engine platforms is advised to capture any changes in the host’s behavior. Organizations that rely on the x.