Researcher flags r0symss2.xyz phishing site impersonating NTT Docomo
Researcher @masaomi346 says r0symss2.xyz is a phishing site impersonating NTT Docomo with a fake d account login form. The domain is also on the Phishing Army blocklist.
- First reported
- Reports
- 1
Source: x.com · published
What happened
On 4 November 2026 the security researcher @masaomi346 posted on X that r0symss2.xyz was a phishing site impersonating NTT Docomo, Japan's largest mobile operator. The post gave the path /KnaeByNf/ on the domain. A screenshot attached to the post shows a login form for a d account, the ID Docomo customers use for billing, d payment and d points, on a domain that is not docomo.ne.jp. The Phishing Army community blocklist, checked by scammers.com on 4 November 2026, also lists r0symss2.xyz.
How the scam works
Docomo-themed phishing usually starts with an SMS or email that claims the customer's bill is unpaid, that points are about to expire, or that the account has been suspended. The link opens a copy of the d account login page. Once the ID and password are entered, these pages commonly ask for the security code sent by SMS, or for card details to update payment information.
With a d account login and code, criminals can make purchases through carrier billing, use d payment balances, or spend d points, and charges may appear on the phone bill. The random-looking .xyz domain and a path made of random characters are typical of campaigns that create many short-lived sites. Docomo's guidance is to check any notice by opening the official My docomo app or site directly, never through a link in a message, and to report suspicious messages. Anyone who entered details should change the d account password immediately, check their purchase and billing history, and contact Docomo. The domain and path come from the researcher's post and have not been independently checked by scammers.com beyond the blocklist listing.
Source
Post by @masaomi346 on X, 4 November 2026 (1:28 AM ET), with a screenshot of the page. Not independently verified by scammers.com.
Red flags
- A d account login form on a domain that is not docomo.ne.jp.
- A random .xyz domain with a random path such as /KnaeByNf/.
- SMS claiming an unpaid bill, expiring points or a suspended line.
- A request for the SMS security code right after the password.
- Requests to update card details through a link.
If you were targeted
- 1Do not enter passwords, card numbers or one-time codes on a page reached from a text, email or ad.
- 2Open the company's official app or type its address yourself to check your account.
- 3If you entered details, change your password at once and contact the company through its official channels.
- 4Report the message and the link to the company and to your national phishing reporting service.
- 5Delete the message without replying or tapping any links.