t-mobile[.]nrqmos[.]top

PhishDestroy identifies t-mobile.nrqmos.top as an active brand impersonation crypto drainer mimicking T-Mobile to siphon cryptocurrency from unwitting visitors. The site uses social engineering to trick users into connecting crypto wallets or revealing seed phrases by falsely claiming urgent account issues or exclusive promotions tied to the T-Mobile brand. Once connected, crypto drainers silently transfer assets to attacker-controlled wallets without requiring further authentication, leading to irreversible financial losses. This domain was flagged by 7 out of 95 VirusTotal security vendors and resolves to IP 188.114.97.3. It was registered on May 10, 2026 through NameSilo,LLC using a Let's Encrypt SSL certificate to appear legitimate. The recent creation date and low VT detection rate suggest a rapidly deployed threat aimed at exploiting trust in the T-Mobile brand before defenses catch up. If you visited t-mobile.nrqmos.top, immediately disconnect your wallet from any connected dApps or websites. Revoke any suspicious permissions through your wallet’s interface and scan your device for malware using reputable antivirus software. Report the domain to your wallet provider, the Federal Trade Commission (reportfraud.ftc.gov), and consider rotating sensitive credentials unrelated to crypto. Never approve unsolicited wallet connection requests—always verify the official domain (tmobile.com) independently.