2025rkt-sa[.]vip

This domain, 2025rkt-sa.vip, is flagged for brand impersonation targeting Rakuten, a major e-commerce and financial services platform. The site mimics Rakuten’s legitimate interface, presenting a page titled 'Home' to deceive users into entering sensitive credentials, such as login details, payment information, or personal data. Brand impersonation attacks of this nature are commonly used to facilitate unauthorized account access, financial fraud, or identity theft, particularly during periods of high user activity, such as promotions or sales events. The lack of SSL encryption further increases the risk of data interception during transmission, exposing users to man-in-the-middle attacks or session hijacking attempts. Analysis indicates the domain was registered on November 05, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domain registrations. Infrastructure analysis reveals the domain resolves to IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.), a network often leveraged to obfuscate the true origin of malicious traffic. The domain appears on one security blocklist and is flagged by 20 out of 95 security vendors on VirusTotal, with detections including phishing, brand impersonation, and malicious URL categories. The absence of an SSL certificate is a critical red flag, as it indicates the site does not encrypt user data, making it vulnerable to interception or tampering. Users who visited 2025rkt-sa.vip should assume their credentials or personal information may have been compromised. Immediate actions include changing passwords for Rakuten and any other accounts where identical credentials were used, enabling multi-factor authentication where available, and monitoring financial statements for unauthorized transactions. If payment details were entered, users should contact their financial institution to report potential fraud and request card replacement or account monitoring. Additionally, scanning the device used to access the domain for malware is recommended, as some phishing sites deploy secondary payloads or exploit kits. Reporting the domain to Rakuten’s security team and relevant authorities can aid in takedown efforts and prevent further victimization.