rakuten-bank-info[.]netlify[.]app

Analysis as of July 29, 2026 identifies rakuten-bank-info.netlify.app as an active banking phishing infrastructure with an elevated risk rating. The domain resolves to the IPv4 address 18.208.88.157, which is hosted on Netlify's shared cloud platform; registration records show the domain was created on May 08, 2018 through Netlify. The site appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, indicating that at least one reputable anti‑phishing consortium has recognized it as malicious.

VirusTotal scans report that 16 out of 91 security vendors flag the domain as malicious, providing independent corroboration of its phishing intent. No additional public indicators such as SSL certificate details, HTTP response codes, or page titles are presently available, leaving the exact content and credential‑harvesting mechanisms unverified. Defenders should prioritize immediate network‑level blocking of the domain and its resolved IP address, incorporate the domain into threat‑intel feeds, and monitor Netlify‑hosted assets for similar naming patterns.

Continuous re‑scanning on multi‑vendor platforms is recommended to capture any changes in detection confidence, and any observed traffic to the IP should be redirected to a sinkhole for further forensic capture. Organizations handling financial credentials should also reinforce user awareness campaigns that reference this specific URL to reduce the likelihood of successful credential submission.