t-mobile[.]kavin[.]icu

This domain, t-mobile.kavin.icu, is flagged as a high-risk phishing site targeting mobile carrier users. Analysis indicates the domain was registered on February 21, 2026, and is currently active. It resolves to Cloudflare infrastructure (AS13335) via IPv6 address 2606:4700:3034::6815:4e4c, with nameservers lars.ns.cloudflare.com and luciane.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), and the site returns an HTTP 301 redirect, though the final destination is unreachable, resulting in a 522 timeout error as reflected in the page title. Thirteen of 93 security vendors on VirusTotal have detected this domain as malicious, and it appears on at least one blocklist. The domain uses Cloudflare hosting and HTTP/3, which may obscure origin details and complicate takedown efforts. No specific phishing kit or brand impersonation beyond the subdomain structure (t-mobile) has been confirmed, but the naming convention strongly suggests intent to deceive users of a major mobile carrier. Defenders should treat this domain as active and malicious. Block resolution at DNS or proxy level, and monitor for any successful connections from internal networks. The domain’s use of Cloudflare and IPv6 may require additional logging to track potential access attempts. Given the 301 redirect behavior, inspect outbound traffic for attempts to follow the redirect chain, even if the final page is currently unreachable. No evidence of compromise or payload delivery has been observed, but the domain remains a credible threat vector.