rakuten-fr[.]cs-post-claim-pictures[.]sgizmo[.]com

The domain rakuten-fr.cs-post-claim-pictures.sgizmo.com is currently flagged as a high‑risk brand‑impersonation site. Infrastructure analysis shows the domain resolves to IP 162.159.135.42, which belongs to AS13335 Cloudflare, Inc. in the United States, indicating the use of Cloudflare’s CDN and DNS services. The authoritative nameservers are dina.ns.cloudflare.com and jack.ns.cloudflare.com, confirming the Cloudflare association. The SSL certificate presented is issued by Amazon with a 2048‑bit RSA key (Amazon RSA 2048 M04), a common certificate for services hosted on Amazon infrastructure, but it does not provide any indication of legitimate ownership.

Registration data reveals the domain was created on May 24 2005 and is registered through Register.com – Network Solutions, LLC, a reputable registrar, yet the age of the domain does not mitigate the observed malicious activity. The HTTP response is a 301 redirect, suggesting the site may forward visitors to another location, a technique often used in phishing campaigns. Trust scoring from Gridinsoft is 0 out of 100, reflecting an extremely low confidence in the domain’s legitimacy. VirusTotal reports that one out of ninety‑five security vendors flagged the domain, and it appears on a single security blocklist, indicating that at least one detection engine has identified malicious behavior.

The page title returned by the server is “Alchemer | Online Survey Software & Tools,” which does not align with the advertised brand and may be intended to disguise the site’s purpose. The known scam type is listed as a crypto scam, further supporting the hypothesis of financial fraud. Defenders should treat the domain as hostile: block it at perimeter firewalls, add it to DNS‑based filtering lists, and monitor for any traffic attempts. Continuous re‑scanning with multi‑vendor services is advised to capture any evolving indicators, and any emails or links referencing the domain should be quarantined pending verification.