t-mobile[.]jpsim[.]icu

This report provides a detailed analysis of the domain t-mobile.jpsim.icu, which was identified as a brand impersonation threat targeting x.com. The domain was registered through Gname.com Pte. Ltd. on December 05, 2025, and was taken offline as of the report date, July 23, 2026. Analysis indicates that 15 out of 95 security vendors flagged this domain, suggesting a significant risk level. The domain appears on one security blocklist, specifically PhishDestroy, which has blocked it to prevent potential phishing attacks.

The nameservers for this domain are benedict.ns.cloudflare.com and janet.ns.cloudflare.com, indicating that Cloudflare, Inc. was used for DNS management. The domain does not have an SSL certificate, which is a common characteristic of phishing sites aiming to avoid the costs and scrutiny associated with secure HTTPS connections. When the domain was active, it resolved to the IP address 172.67.160.120, located in the United States under the ASN AS13335, which is owned by Cloudflare, Inc. The page title for the domain, 'Welcome to nginx!', suggests that the site was hosted using the nginx web server, but does not provide any specific content details. The Gridinsoft trust score for this domain is 0 out of 100, reflecting a high level of distrust and potential malicious intent.

Given the elevated risk level and the domain's current offline status, defenders should monitor for any reactivation and ensure that it is included in organizational blocklists. Additionally, users should be educated about the potential risks associated with visiting unverified or flagged domains, especially those impersonating well-known brands like x.com. Infrastructure analysis reveals that the domain's use of Cloudflare for DNS management and its lack of an SSL certificate are typical tactics employed by threat actors to obscure their activities and reduce costs.