t-mobile[.]tvouz[.]icu

The domain t-mobile.tvouz.icu was registered on 21 February 2026 and is presently taken offline. Passive DNS resolution shows the name pointing to IP address 172.67.221.15, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The TLS certificate presented for the host is identified as “WE1”, indicating a valid‑looking SSL chain that could be used to lend credibility to malicious pages.

Threat intelligence from VirusTotal records that 13 of 93 scanning engines have flagged the domain as malicious, reflecting a moderate level of consensus among automated analysis tools. The domain also appears on a single external blocklist and is explicitly listed by the PhishDestroy mitigation service, reinforcing the assessment that it has been used in phishing campaigns. The classification supplied is “generic phishing”, but no additional context such as targeted brand, page title, or phishing kit has been disclosed, leaving the exact lure and credential‑harvesting mechanisms uncertain.

Defenders should continue to block the domain at perimeter controls and update DNS filtering policies to include the associated IP range. Incident response teams should monitor for residual traffic or credential submissions that may have occurred before the takedown, and consider issuing user advisories that reference the domain name and its Cloudflare hosting to reduce the risk of future impersonation attempts. Ongoing observation of the IP address is recommended in case the infrastructure is repurposed for new campaigns.