t-mobile[.]opuyt[.]icu

The domain t-mobile.opuyt.icu was created on February 21, 2026 and currently resolves to the IP address 104.21.36.133, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents an SSL certificate labeled WE1 and returns the default nginx page with the title "Welcome to nginx!". VirusTotal analysis indicates that 17 of 93 security vendors have flagged the domain as malicious, providing concrete vendor‑based detection evidence. Independent reputation services assign extremely low trust scores—Scamadviser rates the domain at 1/100 and Gridinsoft at 0/100—reinforcing the elevated risk assessment.

The domain is listed on one security blocklist and has been actively blocked by PhishDestroy. It is classified as a brand‑impersonation campaign targeting x.com, though no further content details are available beyond the generic nginx response. At the time of the report the domain is taken offline, limiting immediate takedown actions, but defenders should still treat the indicator set as hostile. Recommended actions include adding t-mobile.opuyt.icu and its associated IP 104.21.36.133 to network deny lists, updating threat‑intelligence feeds with the domain, IP, and SSL fingerprint, and monitoring for any future DNS changes that could reactivate the host.

Because the underlying hosting is provided by Cloudflare, organizations may consider applying broader egress controls or rate‑limiting for traffic to this provider when suspicious activity is observed. Uncertainty remains regarding any specific phishing kit, credential‑stealing forms, or malware payloads, as the only observed page content is the generic server banner. Continuous vigilance, user education about unsolicited links referencing this domain, and enforcement of multi‑factor authentication for x.com accounts are prudent mitigation steps.