t-mobile[.]exumf[.]icu

t-mobile.exumf.icu was observed in multiple security feeds as part of a generic phishing campaign targeting users of the T‑Mobile brand. The domain was registered on 21 February 2026 and resolves to the Cloudflare edge address 172.67.135.142, which is associated with ASN 13335 (Cloudflare, Inc.) and located in the United States. An SSL certificate labeled “WE1” is present, but no further certificate details have been disclosed. Reputation services show a trust score of 0 / 100, and the domain appears on one security blocklist.

Ten of ninety‑three VirusTotal scanners flagged the domain, and PhishDestroy has listed it as blocked. The site is currently offline, preventing direct content analysis; consequently, page‑title, branding, and payload details remain unverified. Nevertheless, the convergence of a newly created domain, low trust score, Cloudflare hosting, and multiple vendor detections strongly indicates malicious intent.

Defenders should add the domain and its resolving IP address to deny‑list rules, monitor for additional sub‑domains under the exumf.icu zone, and enforce URL filtering that blocks connections to the IP range owned by Cloudflare when associated with suspicious activity. Continuous telemetry from DNS logs and proxy feeds is recommended to catch any re‑activation attempts. Organizations that employ T‑Mobile services should alert users to disregard unsolicited communications that reference the brand and encourage verification through official channels.