t-mobile[.]uilko[.]icu

This domain, t-mobile.uilko.icu, was registered on February 21, 2026, and is assessed as a brand-impersonation threat targeting T-Mobile. Analysis indicates the site has been taken offline, though infrastructure details remain relevant for defenders. The domain resolved to 172.67.196.242, a Cloudflare IP (AS13335) located in the US. SSL inspection reveals a certificate issued by WE1, a low-trust issuer often associated with ephemeral phishing campaigns. The page title, 'Welcome to nginx!', suggests a default server configuration, which may indicate either an incomplete deployment or a placeholder used before malicious content was added.

Detection data shows the domain was flagged by 11 of 93 security vendors on VirusTotal, though this does not represent a full consensus. It appears on at least one security blocklist and has been blocked by PhishDestroy. Trust scores from Gridinsoft and Scamadviser both register at 0 or 1 out of 100, reinforcing its high-risk classification. The domain’s creation date aligns with common phishing campaign timelines, where newly registered domains are frequently weaponized within days or weeks. Defenders should treat this domain as part of a larger pattern of Cloudflare-hosted impersonation attempts.

While the site is currently offline, the IP and ASN may still be leveraged for future campaigns. Monitoring for new domains resolving to the same infrastructure or using the same SSL issuer (WE1) could help preempt additional threats. Historical DNS and WHOIS records should be preserved for forensic analysis, as the registrar and hosting provider may yield further indicators of compromise. No evidence of a specific phishing kit or payload has been confirmed, so the exact attack vector remains uncertain.