t-mobile[.]ruqcs[.]icu

Analysis of the domain t-mobile.ruqcs.icu indicates confirmed phishing activity targeting T-Mobile users, classified under the generic phishing threat type with an elevated risk level. The domain, now offline, was registered on December 10, 2025, through Gname.com Pte. Ltd., and utilized Cloudflare nameservers (mariah.ns.cloudflare.com and rick.ns.cloudflare.com). Infrastructure analysis reveals the domain resolved to IP 172.67.141.205, hosted on Cloudflare's network (AS13335) in the United States, employing HTTP/3 and a Google Trust Services SSL certificate (WE1). The page title, 'Welcome to nginx!', suggests the use of a default or misconfigured nginx server, which may indicate an attempt to evade detection or a hastily deployed phishing kit.

Detection data from July 23, 2026, shows 16 of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist, specifically PhishDestroy. The combination of a newly registered domain, Cloudflare hosting, and a default nginx page title is consistent with phishing infrastructure designed to exploit brand recognition while minimizing operational overhead. The domain's offline status as of the report date limits further analysis of its exact content or phishing kit, but the available indicators—including the domain name, detection count, and blocklist presence—strongly support its classification as a credential phishing site targeting T-Mobile customers. Defenders should treat this domain as compromised and prioritize blocking it at the DNS and network levels.

The SSL certificate (Google Trust Services WE1) and Cloudflare hosting do not imply legitimacy, as these are commonly abused by threat actors to lend credibility to phishing campaigns. No evidence links this domain to broader malware distribution or command-and-control activity, but monitoring for related domains using the same registrar (Gname.com Pte. Ltd.