t-mobile[.]cirvo[.]icu

Analysis of t-mobile.cirvo.icu indicates that the domain was registered on 21 February 2026 and is currently taken offline. DNS resolution points to 104.21.64.119, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The TLS certificate presented is identified as WE1, which matches the certificate observed on other phishing infrastructure used in recent campaigns. The domain has been listed on a single security blocklist and is actively blocked by the PhishDestroy sinkhole network.

VirusTotal scans show that ten out of ninety‑five antivirus and URL‑reputation engines have flagged the domain as malicious, providing further corroboration of its phishing intent. No additional public page title, brand targeting, or kit information has been released, so the exact content of the site remains unverified. The combination of recent registration, Cloudflare hosting, a suspicious certificate, and multiple vendor detections aligns with typical patterns of short‑lived phishing infrastructure.

Defenders should continue to block the domain at perimeter filters, add the IP address 104.21.64.119 to deny lists where appropriate, and monitor for any re‑activation or reuse of the same certificate fingerprint. Threat intelligence feeds should be updated to include the domain and its associated indicator set. Ongoing observation of Cloudflare‑hosted assets linked to the WE1 certificate is recommended to detect possible migration of the campaign to new domains.