t-mobile[.]cfdmsx[.]icu

t-mobile.cfdmsx.icu was registered on 21 February 2026 and quickly appeared on a security blocklist. The domain resolves to the IP address 188.114.97.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. VirusTotal analysis shows that 16 of 95 scanned security vendors flagged the domain as malicious, indicating a consensus of detection across multiple engines. The domain is listed as blocked by PhishDestroy, and its SSL certificate is identified as “WE1”.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a lack of confidence in the site’s legitimacy. The site was classified as a generic phishing threat and is currently taken offline, as indicated by the status field. Although the page title and additional content have not been publicly disclosed, the combination of blocklist inclusion, multiple vendor detections, low trust score, and Cloudflare hosting strongly suggests that the domain was used for credential‑stealing or similar phishing activity targeting users who might associate the “t‑mobile” string with the telecommunications brand.

Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for any future re‑use, and consider adding the domain to internal blacklists. Ongoing observation of Cloudflare‑hosted assets linked to the same ASN is recommended, as threat actors often rotate domains while retaining the same hosting infrastructure. Because the domain is already offline, immediate remediation focuses on preventing accidental resolution and ensuring that any cached references are purged from security products.