t-mobile[.]kuyre[.]icu

Analysis of t-mobile.kuyre.icu, observed on July 23, 2026, shows that the domain was registered on February 21, 2026 and subsequently pointed to the IP address 172.67.168.15, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The TLS certificate presented on the host is identified as WE1, and the HTTP response contains the generic server string “Welcome to nginx!”. The site is classified as a brand‑impersonation campaign targeting the x.com brand. Reputation signals indicate a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist.

VirusTotal scans reported that 15 of 93 antivirus and URL‑reputation engines flagged the domain as malicious. The domain has also been listed by the PhishDestroy blocklist, confirming that it was actively used in phishing operations before being taken offline. The observed evidence does not include any additional infrastructure such as command‑and‑control servers, payloads, or specific phishing kits, and the content of the landing page beyond the default nginx title has not been captured.

Consequently, the exact tactics employed by the actors remain uncertain, but the convergence of a low trust score, multiple vendor detections, and blocklist listings strongly suggests that the domain was leveraged to deceive users into providing credentials for x.com. Defenders should ensure that any outbound connections to 172.67.168.15 are blocked at the network perimeter, update web filtering policies to include the domain and its associated IP range, and monitor for similar Cloudflare‑hosted domains that exhibit the same combination of low trust scores and blocklist presence. Ongoing threat‑intel feeds should be consulted for any resurgence of the domain or related indicators of compromise.