t-mobile[.]gnlve[.]icu

This domain, t-mobile.gnlve.icu, is identified as a brand impersonation phishing site targeting users of X.com (formerly Twitter). Analysis indicates the threat actor designed the domain to mimic legitimate T-Mobile branding while redirecting victims to fraudulent X.com login pages, likely intended for credential harvesting or account takeover attempts. No crypto drainer or malware payloads were detected in initial scans, but the infrastructure aligns with credential theft campaigns observed in recent months. Infrastructure analysis reveals the domain was registered on December 5, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with phishing operations. It resolved to IP address 188.114.96.3, hosted on Cloudflare's network (AS13335), a common tactic to obscure origin servers and evade takedowns. The domain currently lacks an SSL certificate, increasing detectability via browser security warnings. VirusTotal detection shows 17 out of 95 security vendors flagged the domain as malicious, while it appears on two active blocklists. The page title 'Welcome to nginx!' suggests a default server configuration, often indicative of hastily deployed phishing infrastructure. As of the latest verification, t-mobile.gnlve.icu has been taken offline, likely following abuse reports or registrar intervention. However, residual risk remains due to the domain's recent creation and the potential for reactivation under the same registrar. Organizations should monitor for DNS re-resolution attempts and include the domain in threat intelligence feeds. Users who may have interacted with the site should reset credentials for X.com and enable multi-factor authentication. Network defenders are advised to block the IP 188.114.96.3 and monitor for related domains registered through Gname.com with similar naming patterns.