rakuten[.]ueno-edp[.]jp

This domain, rakuten.ueno-edp.jp, is flagged as a confirmed phishing site impersonating Rakuten Mobile's login portal. Analysis indicates the page title "楽天会員 ログイン | Rakuten Mobile" directly mimics the legitimate Rakuten authentication interface, targeting users attempting to access their accounts. The threat type is classified as credential harvesting, specifically designed to capture login credentials through a fraudulent login form. No crypto drainer or secondary payload delivery was observed in initial scans, though credential theft remains the primary objective. Infrastructure analysis reveals the domain resolves to IP address 160.251.152.60 and is secured with a Let's Encrypt SSL certificate (R13). VirusTotal detection metrics show 18 out of 95 security vendors flagging the domain as malicious. The domain appears on a single security blocklist and is currently blocked by one known web filtering system. Registrar details and domain creation date remain undisclosed, limiting temporal analysis of the threat actor's infrastructure. Google Safe Browsing status is not explicitly listed, but the domain's offline status suggests takedown or voluntary suspension. Current status indicates the domain is offline, reducing immediate risk to end users. However, residual risk persists due to potential credential reuse by victims prior to takedown. Response actions include domain suspension and inclusion in security blocklists, though no public disclosure of registrar enforcement has been confirmed. Users who accessed the site should immediately reset Rakuten account credentials and monitor for unauthorized transactions. Organizations are advised to update web filters to block the domain and associated IP, while security teams should correlate logs for prior connections to 160.251.152.60.