t-mobile[.]fdhtk[.]icu

Analysis indicates that the domain t-mobile.fdhtk.icu was registered through NameSilo, LLC on 21 February 2026. The domain resolves to the IP address 172.67.207.121, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. HTTP response reveals the generic title “Welcome to nginx!” and the site was observed to be taken offline at the time of reporting. The SSL certificate presented is identified only as “WE1”, without further validation details. The domain is listed on a single security blocklist and has been explicitly blocked by PhishDestroy.

VirusTotal scans show that 10 of 93 antivirus and URL‑filtering engines flagged the domain as malicious, confirming a level of suspicion consistent with its classification as a brand‑impersonation campaign targeting the brand x.com. The Gridinsoft trust score is 0 out of 100, indicating a high likelihood of malicious intent. Nameserver records point to holly.ns.cloudflare.com and randall.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. Evidence confirms that the campaign leverages Cloudflare’s hosting to obscure the true origin of the malicious content, a common tactic for fast‑flux phishing operations. However, the specific phishing kit, landing‑page content, or credential‑harvesting mechanism has not been disclosed, and no Safe Browsing or OTX identifiers are available in the current intelligence set.

Consequently, the full scope of the threat—such as victim targeting patterns or credential capture methods—remains uncertain. Defenders should add t-mobile.fdhtk.icu to blocklists, monitor DNS queries for the associated Cloudflare nameservers, and enforce URL filtering based on the observed detection rate. Incident response teams should treat any email or web traffic referencing the brand x.com that redirects to this domain as malicious, and users should be advised to avoid interaction with the URL.