t-mobile[.]zkxra[.]icu

Analysis of the domain t-mobile.zkxra.icu shows that it was registered on 21 February 2026. The site presents a TLS certificate identified as WE1, indicating that HTTPS is enabled but no further certificate details are available. Infrastructure inspection reveals that the domain resolves to the IP address 172.67.193.42, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Reputation services report a Gridinsoft trust score of 0 out of 100, reflecting an extremely low confidence rating.

VirusTotal scans have returned detections from 15 of 93 security vendors, confirming that multiple anti‑malware engines consider the domain malicious. The domain has been listed on at least one public blocklist and is actively blocked by the PhishDestroy filtering service. Current HTTP probing indicates that the host is offline at the time of this report, which may be an intentional takedown after detection.

The available evidence points to a credential‑harvesting campaign targeting users of the T‑Mobile brand, although the specific landing page content has not been captured. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the IP address in other hostnames, and consider adding the domain to internal blocklists. Ongoing observation of Cloudflare‑hosted infrastructure is recommended, as the provider often serves as a shared platform for multiple malicious actors.