t-mobile[.]docgl[.]cc

This report details the threat site t-mobile.docgl.cc, which impersonates the T-Mobile brand. The page title indicates a "522: Connection timed out" error, suggesting the site is configured to mimic a legitimate service but is currently non-functional. As an impersonation scam, the primary threat is phishing, where visitors could be deceived into providing credentials or personal data under the false pretense of a T-Mobile login or support portal.

Technical analysis confirms the domain is malicious. VirusTotal shows 13 detections out of 95 vendors, with specific flags from ADMINUSLabs, Criminal IP, Cluster25, CRDF, and CyRadar. The domain is registered with Gname.com Pte. Ltd., a known registrar for malicious domains. It was created on February 21, 2026, and resolves to IP address 104.21.13.218, hosted in the US by Cloudflare, Inc. (AS13335). The site has no SSL certificate, indicating a lack of encryption. Nameservers are alexia.ns.cloudflare.com and damian.ns.cloudflare.com.

The site is currently offline, as indicated by the status "DOWN/OFFLINE." The GridinSoft trust rating is 0 out of 100, and the DOM risk score is 10, both indicating high risk. While the site is not operational now, its domain registration and impersonation characteristics pose a significant threat if reactivated. Users should avoid any interaction and block the domain.