t-mobile[.]rtgfd[.]icu

This domain, t-mobile.rtgfd.icu, is assessed as an elevated-risk phishing infrastructure targeting X.com (formerly Twitter) through brand impersonation. Analysis indicates the domain was created on February 21, 2026, and is currently offline as of the report date. It appears on one security blocklist (PhishDestroy) and is flagged by 14 of 93 security vendors on VirusTotal, suggesting detection by multiple threat intelligence sources. The domain resolves to an IPv6 address (2606:4700:3030::ac43:ae6d) hosted on Cloudflare’s network (AS13335), a common choice for phishing campaigns due to its accessibility and perceived legitimacy.

The SSL certificate is classified as WE1, a low-trust indicator often associated with automated or low-effort malicious domains. The page title, 'Welcome to nginx!', suggests the server was either misconfigured or intentionally left in a default state, which is atypical for legitimate brand-hosted sites but consistent with hastily deployed phishing infrastructure. No specific phishing kit or detailed payload analysis is available in the current intelligence, and the exact content of the site remains unconfirmed. However, the combination of brand impersonation targeting X.com, the use of Cloudflare hosting, and the low trust score (0/100 from Gridinsoft) aligns with known phishing tactics.

Defenders should treat this domain as malicious and prioritize blocking it at the DNS, proxy, or firewall level. If retrospective analysis is required, log reviews should focus on connections to the resolved IPv6 address or the Cloudflare ASN. Given the domain’s offline status, no active threat is present, but historical logs may reveal prior compromise attempts. Further investigation into the registrar or hosting provider could yield additional infrastructure linked to this campaign, though no such connections are currently documented.