digitalrakuten[.]com

PhishDestroy identifies digitalrakuten.com as a fake login phishing page impersonating Rakuten, a major Japanese e-commerce platform. The domain was registered through GMO Internet, Inc. on March 20, 2026, and currently resolves to IP 118.27.146.17. The threat actor behind this domain appears to be using it to harvest user credentials under the guise of a legitimate Rakuten login portal, likely to gain unauthorized access to accounts for financial theft or further fraudulent activity. The domain is associated with a crypto drainer kit, designed to siphon cryptocurrency assets from compromised wallets or accounts once login credentials are obtained.

The domain exhibits multiple red flags across technical and behavioral indicators. PhishDestroy’s forensic analysis reveals that 11 out of 95 security vendors on VirusTotal have flagged digitalrakuten.com as malicious, indicating broad recognition of its threat potential. The domain was registered through GMO Internet, Inc., a legitimate registrar, but the timing and context of its creation (March 20, 2026) suggest a recent and opportunistic campaign. It resolves to IP 118.27.146.17, which hosts multiple suspicious domains and has been flagged in various threat intelligence feeds. The domain obtained an SSL certificate from Let’s Encrypt, a tactic commonly used by threat actors to lend an air of legitimacy to phishing pages. Additionally, digitalrakuten.com is not listed in Google Safe Browsing (GSB) and has been identified in 12 public blocklists, further confirming its malicious nature.

As of the latest analysis, digitalrakuten.com remains active and continues to pose an elevated risk to unsuspecting users. PhishDestroy has added this domain to its real-time blocklist, and security teams are actively monitoring its infrastructure for changes. However, the domain’s recent creation and the use of a legitimate SSL certificate mean it may evade detection by less sophisticated security tools. Users are strongly advised to avoid interacting with digitalrakuten.com and verify any suspicious links using PhishDestroy’s verification tools. The remaining risk is elevated due to the domain’s active status and the potential for it to be used in broader phishing campaigns targeting Rakuten users. Immediate action is required to prevent credential theft and financial loss.