t-mobile[.]alevb[.]icu

Analysis of the domain t-mobile.alevb.icu indicates that it was registered on 13 December 2025 through Gname.com Pte. Ltd. and is currently resolved to the Cloudflare‑owned address 104.21.73.136 (AS13335, United States). The site presented the generic page title “Welcome to nginx!” and employed Cloudflare services with HTTP/3 enabled. The TLS certificate, issued by Google Trust Services under the WE1 label, confirms the use of a legitimate certificate authority but does not mitigate the malicious intent. VirusTotal records show that 14 of 95 scanning engines flagged the domain, suggesting a consensus of malicious classification.

Independent threat‑filtering services have added the domain to at least one blocklist and PhishDestroy reports it as blocked. The infrastructure is protected by Cloudflare’s DNS, using the authoritative nameservers anton.ns.cloudflare.com and mona.ns.cloudflare.com. While the domain is presently offline, its recent creation date, hosting profile, and detection history are consistent with a short‑lived phishing infrastructure.

Uncertainty remains regarding the specific phishing payload, target brand, or credential‑ harvesting page because only the page title has been observed. Defenders should continue to deny any network connections to the resolved IP, update firewall and proxy rules to block the domain and its IP range, and monitor for any re‑registration attempts. Threat‑intel feeds should be refreshed to capture any resurgence, and any internal logs referencing the domain should be reviewed for potential compromise attempts.