t-mobile[.]kxvya[.]icu

The domain t-mobile.kxvya.icu was identified as a brand impersonation phishing threat, specifically targeting the social media platform x.com. This domain was designed to deceive users into believing it was affiliated with T-Mobile, leveraging the brand name to appear legitimate. No specific crypto drainer kit was identified, but the impersonation of a major brand suggests potential credential theft or financial fraud.

Technical indicators reveal that the domain has a high-risk profile. VirusTotal flags it with 17 out of 95 security vendors marking it as malicious. It was registered through Gname.com Pte. Ltd. on December 06, 2025, and resolves to IP 188.114.97.3. The domain appears on one security blocklist and has no SSL certificate, further indicating its malicious intent. Google Safe Browsing status was not explicitly provided, but the blocklist presence confirms its dangerous nature.

As of the latest check, the domain is offline, which suggests that either the hosting provider or registrar took action to suspend it. However, the risk remains that similar domains may be created. Users are advised to avoid any interactions with t-mobile.kxvya.icu and to report any suspicious communications claiming to be from T-Mobile or x.com. PhishDestroy recommends enabling multi-factor authentication and verifying URLs before entering credentials.