t-mobile[.]wqewf[.]icu

On July 23, 2026 analysts observed the domain t-mobile.wqewf.icu serving a brand‑impersonation campaign targeting x.com. The domain was registered on 21 February 2026 and presently resolves to the Cloudflare‑owned address 188.114.96.3, AS13335, located in the United States. The host returns an HTTP 200 response with the generic title “Welcome to nginx!”, indicating a default web server page rather than a crafted login portal. SSL inspection shows the certificate labeled “WE1”, but the certificate details have not been disclosed, and no TLS fingerprint matches known phishing kits.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed. VirusTotal analysis recorded detections from ten of ninety‑three scanned scanners, suggesting that multiple AV engines recognize malicious characteristics. Gridinsoft’s trust score of 0 out of 100 reinforces the low credibility of the site. No additional public intelligence such as OTX tags, Safe Browsing entries, or registrar abuse reports were found.

Because the site is currently offline, content‑level verification is limited to the observed page title and infrastructure attributes. The lack of a visible phishing landing page prevents confirmation of the exact credential‑collection method, but the combination of recent registration, Cloudflare hosting, low trust scores, and multiple vendor detections aligns with typical brand‑impersonation infrastructure. Defenders should add t-mobile.wqewf.icu and its resolving IP 188.114.96.3 to network‑level deny lists, ensure that any outbound traffic to the address is blocked, and monitor DNS logs for future re‑registration attempts. Organizations that rely on x.com services should update email‑security rules to flag any correspondence referencing the domain, and threat‑intel platforms should retain the indicator for at least 90 days in case the actor reactivates the domain or deploys a similar payload on a new host.