t-mobile[.]tukqv[.]icu

The domain t-mobile.tukqv.icu was registered on February 21, 2026 and is currently listed as offline. VirusTotal scans show that 16 of 93 security vendors have flagged the domain, indicating a moderate level of detection across multiple AV engines. The site presents an SSL certificate identified as WE1, which does not correspond to a recognized public‑trusted CA and may be a self‑signed or otherwise anomalous certificate. DNS resolution points to IP address 172.67.197.185, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States.

The hosting provider therefore offers the typical abstraction and CDN protections associated with Cloudflare, but the IP itself is shared among many unrelated services, limiting attribution to a single threat actor. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, reinforcing the assessment that it is being used for malicious purposes. Additionally, Gridinsoft assigns a trust score of 0 out of 100, effectively rating the domain as completely untrusted. No further details about page content, HTTP response codes, or specific phishing lures are available in the current intelligence set.

Given the combination of vendor detections, low trust score, blocklist inclusion, and a non‑standard SSL certificate, defenders should treat t-mobile.tukqv.icu as a high‑confidence phishing indicator. Recommended mitigation steps include adding the domain to DNS and proxy deny lists, monitoring the associated Cloudflare IP for any re‑use in future campaigns, and ensuring endpoint protection solutions are updated to reflect the 16 vendor detections. Continuous re‑scanning on VirusTotal and similar platforms is advised to capture any changes in classification, and any observed traffic to the domain should be logged and investigated for potential credential harvesting attempts.