lenoelderakuten[.]com

The domain lenoelderakuten.com was registered on 24 October 2025 through OVH SAS and is served by the authoritative name servers dns16.ovh.net and ns16.ovh.net. The public‑facing page returns the title “Le noël de Rakuten” and responds with HTTP status 200. No further content analysis is available beyond the title. Network resolution points the domain to the single IPv4 address 51.91.236.255, which belongs to the OVH network (AS16276) and geolocates to France. The site presents a typical WordPress stack, with MySQL, PHP, jQuery, jQuery Migrate and Google Analytics libraries detected. TLS is provided by a Let’s Encrypt certificate issued under the E7 profile. Threat intelligence sources corroborate malicious use. AlienVault Open Threat Exchange lists the domain in fifteen separate pulses, and VirusTotal records fourteen of ninety‑five scanners flagging it as malicious. The domain appears on two public phishing blocklists and is currently blocked by PhishDestroy and PhishingDB. Independent reputation scoring assigns a Gridinsoft trust rating of 1 out of 100, indicating severe risk. While the observed indicators confirm the domain’s involvement in a generic phishing operation targeting users of the Rakuten brand, the specific payload, credential‑capture mechanisms, and victim distribution remain undocumented in the available data. Defenders should continue to block the domain at perimeter firewalls, DNS resolvers, and web proxies, and consider adding the IP address 51.91.236.255 to blacklists. Continuous monitoring of the OVH name‑server range for newly created domains with similar characteristics is recommended, as well as periodic re‑scanning of the site for potential changes in the underlying WordPress content.