t-mobile[.]ineby[.]icu

This domain, t-mobile.ineby.icu, was registered on December 5, 2025, through Gname.com Pte. Ltd. and is assessed as a brand impersonation threat targeting x.com. Infrastructure analysis reveals Cloudflare hosting (AS13335) with nameservers pola.ns.cloudflare.com and walt.ns.cloudflare.com, resolving to 188.114.97.3 in the US. The domain currently returns an HTTP status indicating it is offline, with a page title of 'Welcome to nginx!', suggesting a default server configuration or misconfigured deployment. No SSL certificate is present, which is atypical for legitimate brand domains but common in hastily deployed phishing infrastructure.

Detection data shows 15 of 95 security vendors on VirusTotal flagged this domain as malicious, and it appears on one security blocklist, corroborating its classification as a phishing threat. The domain was blocked by PhishDestroy and assigned a trust score of 0/100 by Gridinsoft. While the exact content of the phishing kit is not yet analyzed, the combination of brand impersonation targeting, Cloudflare hosting, and detection by multiple security vendors indicates elevated risk.

Defenders should treat this domain as malicious and prioritize blocking it at DNS, proxy, and endpoint layers. Given its offline status, monitoring for reactivation or related domains using the same registrar or hosting infrastructure is recommended. No evidence of widespread campaign activity or additional attack vectors is currently available.