t-mobile[.]sjuak[.]icu

The domain t-mobile.sjuak.icu was registered on February 21, 2026 and is currently listed as offline. Infrastructure analysis shows the domain resolves to the IP address 172.67.140.224, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The SSL certificate presented is identified as WE1, and the HTTP response returns the default page title "Welcome to nginx!" indicating no custom content was served at the time of observation. The site is classified as a brand‑impersonation campaign targeting the brand x.com, as indicated by the known intelligence.

Detection services have flagged the domain: PhishDestroy has blocked it, and it appears on one public security blocklist. VirusTotal scans report that ten out of ninety‑three antivirus and URL‑reputation engines flagged the domain as malicious. Reputation services assign extremely low trust scores, with Gridinsoft reporting 0 out of 100 and Scamadviser rating the domain at 1 out of 100. These metrics collectively suggest a high likelihood of malicious intent despite the current offline status.

Defenders should continue to block any traffic to the domain and its associated IP range, monitor for any re‑activation or similar sub‑domains hosted on the same Cloudflare edge, and incorporate the domain and IP into threat‑intel feeds. Additional investigation is warranted to determine whether the site ever hosted a phishing page mimicking x.com, as the present evidence is limited to infrastructure and reputation data. Continuous verification with URL‑reputation services and passive DNS monitoring is recommended to capture any future changes in the domain’s operational status.