t-mobile[.]mvzkw[.]icu

The domain t-mobile.mvzkw.icu was registered on February 21, 2026 and is currently listed as offline. Infrastructure analysis shows it resolves to the IP address 172.67.142.51, which belongs to the Cloudflare network (ASN 13335) and is geolocated in the United States. The SSL certificate presented by the host is identified only as “WE1,” providing no meaningful validation of the site’s identity. Reputation services indicate a severe lack of trust: Gridinsoft assigns a score of 0 out of 100, and the domain appears on a single security blocklist.

Additional filtering by PhishDestroy confirms that the domain is being actively blocked. VirusTotal scans report that 16 of 93 antivirus and URL‑reputation engines flag the domain as malicious, reinforcing the suspicion of abuse. The available evidence points to a generic phishing operation, although the exact lure or target brand has not been disclosed in the collected intelligence. Because the site is already offline, immediate containment actions such as DNS sink‑holing or firewall deny rules are recommended to prevent accidental resolution if the host is re‑activated.

Defenders should also add the domain and its associated IP address to internal blocklists and monitor for any future registration attempts that reuse the same second‑level or sub‑domain pattern. Continuous re‑query of threat‑intel feeds for updates on the domain’s status will ensure that any resurgence is detected promptly. Until further forensic detail becomes available, the domain should be treated as high‑risk and excluded from any trusted web‑traffic allowances.