t-mobile[.]qfert[.]icu

This report details a threat identified at t-mobile.qfert.icu. The site's page title was "Welcome to nginx!", indicating a default web server installation. It was classified as an impersonation scam, specifically targeting the brand x.com. The primary threat posed by this site was phishing, as it was designed to deceive visitors into believing they were interacting with a legitimate x.com service, thereby potentially capturing sensitive user credentials or personal data.

Technical analysis reveals the domain was created on 2026-02-21. The site was hosted on IP address 172.67.220.132, located in the United States, under AS13335 (Cloudflare, Inc.). It used a WE1 SSL certificate. VirusTotal flagged the site with 11 out of 95 detections. It was flagged by security vendors including Criminal IP, CyRadar, ESET, Fortinet, and G-Data, and appeared on one blocklist. The GridinSoft trust score was 0 out of 100, and the DOM risk score was 73.

The domain t-mobile.qfert.icu is currently reported as DOWN or OFFLINE, meaning it is no longer accessible. The risk level associated with this domain is considered high, as indicated by the elevated DOM risk score of 73 and the zero trust rating from GridinSoft, combined with its confirmed impersonation activity.