t-mobile[.]odevy[.]cc

t-mobile.odevy.cc was observed as a malicious infrastructure element associated with generic phishing. The domain was registered on February 21, 2026 and subsequently taken offline, as indicated by the current status. DNS resolution points to the IPv4 address 188.114.97.3, which belongs to AS13335 operated by Cloudflare, Inc., located in the United States. The site presented an SSL certificate identified as WE1, suggesting the use of a publicly‑available or mis‑issued certificate rather than a brand‑specific credential.

On VirusTotal the domain received 18 positive detections out of 95 scanned security vendors, demonstrating a moderate level of consensus among commercial scanners that the host is malicious. It is listed on a single external blocklist and has been explicitly blocked by the PhishDestroy mitigation service. No additional public threat‑intel feeds such as OTX, Safe Browsing, or registrar‑level reputation data were found for this FQDN, and the page title and content have not been publicly disclosed.

The combination of recent registration, Cloudflare fronting, a non‑brand SSL certificate, and multiple vendor detections indicates a purpose‑built phishing infrastructure that was likely used to lure victims before being shut down. Defensive teams should ensure that the IPv4 address 188.114.97.3 is added to network‑level deny lists, monitor for any resurgence of the domain or similar sub‑domains hosted on the same Cloudflare ASN, and enforce TLS inspection policies that flag certificates lacking expected brand attributes. Continuous re‑query of VirusTotal and blocklist services is advised in case the domain reappears, and any email or web traffic that references “t‑mobile.odevy.cc” should be treated as malicious.