t-mobile[.]chvuw[.]icu

The domain t-mobile.chvuw.icu has been identified as a credential phishing site targeting T-Mobile customers. Analysis confirms the domain is designed to mimic legitimate T-Mobile login portals, tricking users into submitting sensitive account information. The site is currently offline, but prior activity indicates a focused effort to capture usernames, passwords, and potentially multi-factor authentication codes. Infrastructure analysis reveals the domain was registered on February 21, 2026, and resolves to the IP address 172.67.191.249, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain appears on one security blocklist and is flagged by 15 of 95 security vendors on VirusTotal. The SSL certificate is classified as WE1, indicating a low-trust or automated issuance, which is common in phishing campaigns. The domain's creation date suggests it was deployed specifically for short-term malicious use, a tactic often employed to evade detection and takedown efforts. At present, t-mobile.chvuw.icu is offline, reducing immediate risk to end users. However, the infrastructure remains a potential vector for future attacks. Organizations are advised to block the domain and its associated IP (172.67.191.249) at the network perimeter. Users who may have interacted with the site should reset their T-Mobile credentials immediately and enable multi-factor authentication if not already active. Security teams should monitor for related domains using the same seed pattern (f11db0) or similar naming conventions, as threat actors frequently reuse infrastructure for subsequent campaigns.