t-mobile[.]fkzoi[.]icu

The domain t-mobile.fkzoi.icu was registered on 21 February 2026 and is currently marked as offline. DNS resolution points to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The site presents a TLS certificate identified as “WE1”, indicating the use of a publicly‑trusted certificate but providing no further validation of the host identity. PhishDestroy has explicitly blocked the domain, and it appears on a single external security blocklist.

VirusTotal analysis shows that 8 out of 93 scanning engines have flagged the domain as malicious, reinforcing the suspicion of phishing activity. No additional public blocklists, Safe Browsing entries, or Open Threat Exchange (OTX) references were observed in the available intelligence. Likewise, the page title, brand target, or any phishing‑kit attribution have not been disclosed, leaving the exact content of the site unknown.

Defenders should continue to enforce DNS‑level blocking for t-mobile.fkzoi.icu, monitor the associated IP address for any resurgence, and consider adding the host to local threat‑intel feeds. Given the Cloudflare hosting, a sinkhole or firewall rule that inspects outbound traffic to the IP can help detect any future re‑activation. Ongoing correlation with updated VirusTotal scans and blocklist feeds is recommended to capture any changes in detection scores.