t-mobile[.]haioe[.]icu

The domain t-mobile.haioe.icu was registered on February 21, 2026 and is currently taken offline. Infrastructure analysis shows it resolves to the IP address 172.67.202.201, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The site presented a TLS certificate identified as WE1, indicating the use of a possibly self‑signed or low‑trust certificate.

Detection platforms have observed malicious activity: VirusTotal recorded 11 detections out of 93 scanned vendors, and the domain is listed on a single security blocklist. PhishDestroy has actively blocked the domain, confirming its involvement in credential‑phishing operations. No additional public intelligence such as OTX entries, Safe Browsing reports, or page‑title information is available at this time, and the exact phishing kit or lure content has not been disclosed.

Given the confirmed detections, blocklist presence, and Cloudflare hosting, defenders should add t-mobile.haioe.icu to URL filtering and DNS block policies, enforce TLS inspection to capture any encrypted traffic, and monitor the associated IP for any future re‑use. Continuous review of Cloudflare‑hosted IPs for similar activity is advised, as the infrastructure can be repurposed for new phishing campaigns.