t-mobile[.]ksjdhk[.]icu

t-mobile.ksjdhk.icu was registered on 21 February 2026 through Gname.com Pte. Ltd. The authoritative nameservers are A.SHARE-DNS.COM and B.SHARE-DNS.NET. DNS resolution points to 172.67.163.122, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The domain is currently taken offline, which may be the result of remediation by defenders or a temporary shutdown by the operators. Security telemetry shows the domain appears on a single blocklist and is actively blocked by the PhishDestroy service.

VirusTotal analysis recorded detections from 11 of 93 scanned AV engines, indicating that at least a subset of scanners identified malicious payloads or behavior associated with the host. The SSL certificate presented for the site is identified as “WE1”, a generic certificate often used by disposable hosting services. Gridinsoft’s trust scoring system rates the domain at 0 out of 100, reinforcing its classification as high‑risk. Given the elevated risk rating, defenders should continue to deny any network traffic to t-mobile.ksjdhk.icu and monitor the associated IP address (172.67.163.122) for re‑use.

Because the domain resolves through Cloudflare’s network, any future resurrection could inherit the same edge infrastructure, so threat‑intel feeds should be updated to include the nameservers and registrar details. Automated blocklists that already reference the domain can be reinforced, and endpoint protection policies should be tuned to trigger on the 11 VirusTotal‑positive signatures. Until additional forensic artifacts (such as page title, brand targeting, or phishing kit) become available, the precise lure employed by the site remains unknown. Continuous observation of related sub‑domains and any new registrations using the same registrar or nameserver pair is recommended to pre‑empt potential re‑deployment.