t-mobile[.]wyrox[.]icu

This domain, t-mobile.wyrox.icu, is flagged as a tech support scam impersonating Apple, despite its page title suggesting a T-Mobile promotions site. Infrastructure analysis reveals the domain was registered on February 21, 2026, and is hosted behind Cloudflare (AS13335) at IP 104.21.42.198, located in the US. The SSL certificate is issued by WE1, a common provider for low-trust or ephemeral domains.

At the time of assessment, the domain appears on one security blocklist and is blocked by PhishDestroy, while 12 of 95 security vendors on VirusTotal have flagged it as malicious. The discrepancy between the page title (T-Mobile Tuesdays - Get Free Stuff & Great Deals | T-Mobile) and the reported brand target (Apple) suggests either misdirection or a dual-purpose scam infrastructure. The domain is currently offline, but defenders should treat it as high-risk due to its confirmed impersonation of a major brand, presence on blocklists, and detection by multiple security vendors.

No evidence of a specific phishing kit or additional infrastructure links is available, but the domain’s registration age and hosting behind a CDN are consistent with short-lived scam campaigns. Defenders are advised to monitor for re-emergence, block the domain and associated IP at perimeter controls, and review logs for connections to 104.21.42.198 or related Cloudflare-hosted endpoints. The exact content of the site remains unanalyzed, but the combination of brand impersonation, blocklist presence, and vendor detections justifies elevated scrutiny.