t-mobile[.]kciren[.]cc

t-mobile.kciren.cc was registered on 2026-02-03 through Gname.com Pte. Ltd. The domain resolves to IP 172.67.199.230, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. DNS resolution is provided by the authoritative nameservers A.SHARE-DNS.COM and B.SHARE-DNS.NET. The site presented a TLS certificate labeled WE1, but no additional certificate details are disclosed. VirusTotal analysis recorded 14 of 93 scanning engines flagging the domain as malicious, indicating a moderate level of consensus among security vendors.

The domain appears on a single external security blocklist and has been actively blocked by the PhishDestroy filtering service. Although the exact page title and targeted brand are not provided, the classification as generic phishing suggests the site was used to harvest credentials, likely impersonating a mobile carrier. The domain was taken offline prior to the report date, so current HTTP status is unavailable.

Uncertainty remains regarding the specific phishing kit, payload delivery method, and any associated command‑and‑control infrastructure, as no further artefacts have been published. Defenders should continue to block the domain at network perimeters, add the IP address 172.67.199.230 to deny lists, and monitor for newly registered subdomains using the same registrar or nameserver pair. Ongoing threat‑intel feeds should be consulted for any resurgence of the domain or related infrastructure, and internal logs referencing connections to the IP or domain should be investigated for potential compromised credentials.