dhj[.]szytnfbl[.]top

The domain dhj.szytnfbl.top has been identified as a phishing site specifically targeting Rakuten customers. This threat is a brand impersonation scam designed to harvest login credentials and potentially financial information from unsuspecting users. The site mimics Rakuten's interface to deceive visitors into entering sensitive data, making it a clear case of credential theft.

Technical analysis reveals several red flags. VirusTotal reports 16 out of 95 security vendors flagging this domain as malicious, indicating widespread recognition of its threat. The domain was registered on April 02, 2026, through Gname.com Pte. Ltd., a registrar often associated with suspicious activities. It resolves to IP address 188.114.96.3 and uses an SSL certificate from Let's Encrypt (E7), which, while legitimate, is frequently abused by phishing operators. The site appears on 1 security blocklist, and Google Safe Browsing likely marks it as deceptive.

As of the latest check, the domain is offline, likely taken down following reports or enforcement actions. However, the risk remains that similar domains may appear. Users who may have visited the site should change their Rakuten passwords immediately and monitor accounts for unauthorized activity. PhishDestroy recommends enabling two-factor authentication and avoiding clicking links in unsolicited emails or messages claiming to be from Rakuten.