t-mobile[.]wlmeb[.]icu

Analysis of the domain t-mobile.wlmeb.icu, first observed on 6 December 2025, shows that it was registered through Gname.com Pte. Ltd. and points to the IP address 104.21.88.41, which belongs to Cloudflare (AS13335) located in the United States. The domain resolves via the Cloudflare authoritative name servers cameron.ns.cloudflare.com and noor.ns.cloudflare.com. No TLS certificate is presented, and an HTTP request returns the default nginx page titled “Welcome to nginx!”. The lack of a valid certificate combined with the generic server banner suggests an infrastructure deliberately kept minimal. VirusTotal records indicate that 15 of 95 scanning engines flagged the domain, reflecting a moderate level of detection consensus.

The site appears on a single public blocklist and has been added to the PhishDestroy blocklist, confirming that at least one security service recognized it as malicious. The Gridinsoft trust score of 0 out of 100 further corroborates its low reputation. The domain is categorized as a Brand Impersonation campaign targeting the brand x.com, although the visible content does not yet reveal a specific phishing page. Current operational status is offline, which may indicate removal or a temporary takedown.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no page content beyond the nginx placeholder has been captured. Defenders should continue to block traffic to the domain and its associated IP, monitor DNS queries for the domain or its name‑server pair, and enforce outbound filtering for connections to Cloudflare edge nodes that resolve to 104.21.88.41. Additionally, incident response teams should verify whether any internal users have interacted with the domain before its takedown and consider updating web‑filtering rules to include the observed hostnames and name servers. Ongoing threat‑intelligence feeds should be consulted for any re‑appearance of the domain or related subdomains.