t-mobile[.]qlmxk[.]icu

The domain t-mobile.qlmxk.icu has been identified as a brand impersonation phishing resource targeting users of the x.com platform. Analysis confirms its current status as offline, though prior activity indicates an elevated risk classification due to its deceptive infrastructure. The domain was explicitly designed to mimic x.com, leveraging familiar branding elements to facilitate credential harvesting or other malicious interactions. Infrastructure analysis reveals the domain was registered on February 21, 2026, and resolves to the IP address 188.114.96.3, hosted on autonomous system AS13335, a network frequently associated with content delivery and proxy services. Detection metrics indicate the domain was flagged by 17 of 95 security vendors on VirusTotal, while a single security blocklist entry further corroborates its malicious classification. The SSL certificate, identified as WE1, provides no additional trust indicators, and the page title 'Welcome to nginx!' suggests default server configurations often exploited in phishing deployments. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to implement DNS-based blocking for t-mobile.qlmxk.icu and its associated IP address 188.114.96.3. Security teams should review logs for connections to this domain and conduct user awareness training emphasizing the risks of brand impersonation tactics. Proactive monitoring of newly registered domains containing 't-mobile' or 'x' in their subdomains is recommended to mitigate similar threats.