t-mobile[.]irnjg[.]icu

The domain t-mobile.irnjg.icu was observed as part of a brand‑impersonation campaign targeting the x.com brand. Registration records show the domain was created on 8 December 2025 via Gname.com Pte. Ltd., and the authoritative name servers are damon.ns.cloudflare.com and gail.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. The domain resolves to the IP address 104.21.43.193, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was presented; HTTP requests return the default “Welcome to nginx!” page, suggesting the server is running a generic Nginx instance without a configured certificate.

Threat intelligence scoring assigns a Gridinsoft trust score of 0 / 100, reflecting the highest confidence of malicious intent. VirusTotal analysis reports that 19 of 95 scanning engines flag the domain as malicious, and the domain appears on a single external blocklist. PhishDestroy has already taken the domain offline, and the current status is listed as offline. The evidence set confirms that the infrastructure is typical of CDN‑based phishing operations: Cloudflare front‑end, lack of SSL, and rapid domain turnover.

However, the exact payload or credential‑harvesting page has not been captured; the only visible content is the generic Nginx welcome banner. Consequently, the full scope of the impersonation—such as specific URL paths or phishing forms—remains unknown. Defenders should add 104.21.43.193 and t-mobile.irnjg.icu to their deny lists, monitor for newly registered domains using the same registrar or name‑server pattern, and enforce strict verification of TLS certificates for any traffic purporting to originate from x.com. Continuous re‑scanning with multi‑engine services is advised to capture any future changes in the domain’s status.