t-mobile[.]pwtmj[.]icu

Analysis indicates that the domain t-mobile.pwtmj.icu was registered on 21 February 2026 and is currently taken offline. The site presented the page title “Security Verification – Please Wait,” a common lure used in credential‑harvesting campaigns. Infrastructure inspection shows the domain resolves to IP address 188.114.96.3, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The SSL certificate presented is identified as “WE1,” providing no indication of a trusted certificate authority.

Reputation services rate the domain poorly: Gridinsoft assigns a trust score of 0 / 100, and Scamadviser also reports a score of 0 / 100. The domain appears on one public security blocklist and has been actively blocked by PhishDestroy. VirusTotal analysis recorded 12 detections out of 93 scanning engines, confirming that a subset of security vendors consider the site malicious. No further intelligence such as OTX tags, Safe Browsing status, or additional host‑based indicators is available.

Because the site is offline, live interaction cannot be verified, but the combination of a freshly created domain, low trust scores, blocklist presence, and multiple vendor detections strongly suggests a phishing operation targeting users who might believe they are interacting with a T‑Mobile verification page. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any residual traffic to the associated IP address, and update detection signatures to include the observed page title and certificate fingerprint. Continued observation of the IP range owned by Cloudflare is advised, as the infrastructure may be reused for related campaigns.