t-mobile[.]scuie[.]icu

The domain t-mobile.scuie.icu was registered on February 21, 2026 and currently resolves to the IP address 104.21.59.154, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. HTTP requests return the default nginx welcome page, with the title “Welcome to nginx!”. The site presents a brand‑impersonation profile targeting the x.com service, as indicated by the listed scam type and the explicit “Impersonates: x.com” tag. Security telemetry shows that the domain appears on a single public blocklist and has been actively blocked by PhishDestroy.

Reputation services assign a trust score of zero out of one hundred on both Scamadviser and Gridinsoft, reflecting a lack of legitimacy. VirusTotal analysis reports that 14 out of 93 scanning engines have flagged the domain for malicious activity, reinforcing the suspicion of abuse. The SSL certificate associated with the host is identified only as “WE1”, providing no further validation of the operator’s identity. As of the report date, the infrastructure has been taken offline, and no active HTTP service is reachable.

Analysis indicates that the combination of a recent registration, use of a reputable CDN IP range, default server response, low reputation scores, and multiple vendor detections constitute strong evidence of a phishing or credential‑harvesting operation that pretends to represent x.com. Defenders should add the domain and its resolved IP to blocklists, enforce DNS sink‑hole rules, and monitor Cloudflare‑hosted sub‑domains for similar patterns. Continuous re‑evaluation is advised in case the site resurfaces, and any observed traffic should be logged for forensic correlation with known phishing campaigns targeting x.com.