t-mobile[.]anoce[.]icu

Analysis of t-mobile.anoce.icu indicates that the domain was created on 21 February 2026 and is currently offline. DNS resolution points to 104.21.40.59, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The SSL certificate presented is identified as “WE1”, but no further validation details are available. Reputation services assign a zero‑point trust score: Scamadviser rates the site 0/100 and Gridinsoft also reports 0/100, reflecting extreme lack of credibility.

The domain is listed on a single security blocklist and is explicitly blocked by PhishDestroy, reinforcing its malicious classification. VirusTotal analysis shows that 13 out of 93 scanning engines have flagged the domain as malicious, which aligns with the observed “Tech Support Scam” label in the intelligence. The claimed brand target is Apple, yet the page title returned during the scan reads “T‑Mobile Tuesdays – Get Free Stuff & Great Deals | T‑Mobile”, suggesting a mismatch between the advertised brand and the content used to lure victims. This discrepancy is typical of brand‑impersonation campaigns that repurpose legitimate‑looking titles to gain trust.

Because the site is offline, active payload delivery cannot be confirmed, but the combination of a newly registered domain, low trust scores, multiple vendor detections, and blocklist presence provides a strong indicator of malicious intent. Defenders should add the domain to local deny lists, monitor for any future re‑hosting of the same host name or similar sub‑domains under the anoce.icu suffix, and consider tightening email filters for Apple‑related phishing attempts that reference this domain. Continuous observation of the associated IP address and Cloudflare‑originating infrastructure is advised, as adversaries may relocate the malicious payload to a different host while retaining the same CDN.