t-mobile[.]xelvo[.]icu

The domain t-mobile.xelvo.icu was created on 21 February 2026 and is currently listed as offline. Infrastructure analysis shows the hostname resolves to the IP address 172.67.220.90, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The SSL certificate presented for the host is identified as “WE1”, indicating a generic or self‑issued certificate without extended validation. The domain appears on a single public security blocklist and has been explicitly blocked by the PhishDestroy service, confirming its classification as a malicious resource.

VirusTotal reports that 13 of 93 scanned security vendors have flagged the domain, reinforcing the suspicion of malicious intent. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. No additional details such as page title, brand targeting, or specific phishing kit have been disclosed, leaving the exact content of the site unknown.

Defenders should add the domain and its associated IP address to network‑level deny lists, enforce DNS sinkholing, and ensure that any outbound connections to Cloudflare‑hosted addresses are inspected for anomalous payloads. Continuous monitoring of the IP range 172.67.220.0/24 is advised, as threat actors frequently reuse Cloudflare endpoints for short‑lived campaigns. Because the domain is already offline, immediate containment is straightforward, but the infrastructure pattern—newly registered sub‑domain, Cloudflare front‑end, and low trust scores—should be incorporated into detection rules to catch future iterations that reuse similar tactics.