t-mobile[.]juhbw[.]icu

The domain t-mobile.juhbw.icu was registered on February 21, 2026 and is currently taken offline, limiting real‑time traffic observation. DNS resolution points to the IP address 188.114.97.3, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. VirusTotal analysis shows that eight of ninety‑three scanning engines have flagged the domain as malicious, indicating a consensus among a subset of security vendors that the site is associated with phishing activity.

The domain’s trust score, as measured by Gridinsoft, is 0 out of 100, reflecting an extreme lack of credibility. It appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, further corroborating its malicious intent. The SSL certificate presented for the host is identified as "WE1," but no additional certificate details (such as issuer or validity period) are provided.

Because the site is offline, content‑level indicators such as page title, brand targeting, or phishing kit signatures are unavailable, leaving the exact phishing vector unconfirmed. Defenders should continue to block the associated IP address at network perimeters, enforce DNS sinkholing for the domain, and monitor for any re‑registration attempts. Updating intrusion detection signatures with the observed IP and domain identifiers, and ensuring endpoint protection solutions incorporate the eight vendor detections, will reduce exposure to potential future campaigns that reuse this infrastructure.