t-mobile[.]jdsyy[.]icu

Analysis of the domain t-mobile.jdsyy.icu, created on February 21, 2026, shows it resolves to the IP address 104.21.67.18, which is owned by Cloudflare, Inc. (AS13335) and geolocates to the United States. The domain is currently listed as offline, having been taken offline after detection. It is blocked by the PhishDestroy mitigation service and appears on one external security blocklist.

The SSL certificate in use is identified as "WE1," indicating a publicly trusted certificate but offering no indication of legitimacy. VirusTotal scans record that ten out of ninety‑three security vendors have flagged the domain as malicious, reinforcing the suspicion of phishing activity. No additional intelligence such as page title, brand targeting, or specific scam kit has been disclosed, leaving the exact phishing campaign details unverified.

Defenders should continue to block traffic to 104.21.67.18, monitor for any future re‑registration of the domain, and incorporate the domain hash into threat‑intel feeds. Network filtering solutions that rely on community blocklists should already be intercepting requests to this host, but organizations using custom allow‑lists should verify that t-mobile.jdsyy.icu is excluded. Continuous observation of Cloudflare‑hosted IP ranges for similar patterns is advised, as the infrastructure could be repurposed for other malicious operations.