t-mobile[.]gayye[.]icu

This domain is flagged as an elevated-risk brand impersonation phishing site designed to deceive users of the social media platform X.com. Analysis indicates the infrastructure was specifically crafted to mimic legitimate login portals, likely to harvest credentials or distribute malicious payloads under the guise of official branding. The threat type aligns with known patterns of credential theft campaigns, where attackers exploit trust in recognizable brands to bypass user vigilance. Infrastructure analysis reveals the domain t-mobile.gayye.icu was registered on February 21, 2026, and currently resolves to the IP address 172.67.170.53, hosted on Cloudflare’s network (AS13335) in the United States. The site’s SSL certificate is issued by WE1, a detail often observed in ephemeral phishing operations. Detection metrics show 9 of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on at least one security blocklist. The page title, 'Welcome to nginx!', suggests either misconfigured or intentionally minimalistic hosting to evade automated detection tools. The domain’s rapid takedown further supports its classification as a short-lived, high-velocity phishing asset. Mitigation measures for this threat type include immediate blocking of the domain and its resolving IP (172.67.170.53) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate issuer (WE1) into endpoint detection and response (EDR) systems. Users who may have interacted with the domain should be instructed to reset credentials for X.com and any accounts where password reuse occurred. Security teams are advised to monitor for follow-up campaigns leveraging similar infrastructure, particularly domains registered through the same registrar or resolving to Cloudflare IPs, as these patterns are recurrent in credential harvesting operations.