t-mobile[.]pyduw[.]icu

The domain t-mobile.pyduw.icu was registered on 21 February 2026 and is currently listed as offline. DNS resolution points to 188.114.96.3, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The TLS certificate presented for the host is identified as "WE1", but no further validation details are available. Reputation services uniformly assign the lowest possible scores: Gridinsoft rates the site 0 out of 100 and Scamadviser also returns 0 out of 100, indicating a lack of trust. VirusTotal analysis shows that 13 of 93 antivirus and URL scanning engines flag the domain as malicious, reinforcing the suspicion of phishing use.

The domain is actively blocked by the PhishDestroy feed and appears on one additional security blocklist, confirming that at least some industry‑wide filters have incorporated it. The evidence points to a generic phishing infrastructure targeting users who might be deceived by the "t‑mobile" keyword embedded in the sub‑domain. However, no page title, brand confirmation, or specific phishing kit information has been extracted, so the exact lure and credential‑harvesting method remains undefined. The offline status suggests that the operator may be rotating domains or temporarily suspending the site to evade takedown efforts.

Defenders should continue to block any DNS resolution to 188.114.96.3 for this hostname, add t-mobile.pyduw.icu to internal blocklists, and monitor for similar sub‑domains that incorporate the "t‑mobile" brand. Because the underlying IP belongs to a shared Cloudflare network, traffic anomalies should be evaluated in the context of other known malicious hosts sharing the same address space. Regular re‑scanning on VirusTotal or equivalent sandbox services is advised to capture any changes in payload or classification. Organizations should also advise users to verify URLs carefully and to report any unexpected prompts for T‑Mobile credentials to their security teams.