Skip to content
Scammers.com
PhishingReviewed

MUFG Bank phishing sites mufg-co-jp.digital and mufg-co-jp.best

Researcher kubotaa reported MUFG Bank phishing sites at mufg-co-jp.digital and mufg-co-jp.best on October 13, 2026.

First reported
Reports
1

Source: x.com · published

Illustration: Phishing, texts and email scams

What happened

In a post on X on October 13, 2026, security researcher kubotaa (@kubotaa3) reported phishing sites impersonating Japan's MUFG Bank (Mitsubishi UFJ) at mufg-co-jp.digital/MUFG and mufg-co-jp.best/MUFG.

The post listed the hosting IP as 8.209.233.91 (AS45102, Alibaba (US) Technology) and the registrar as NameSilo, and linked a scan log. MUFG's real site uses the bk.mufg.jp domain; MUFG was impersonated, not involved.

How the scam works

Bank phishing in Japan usually starts with a text message or email warning of a problem with your account or a security check. The link leads to a copy of the bank's login page on a lookalike domain, here built from "mufg-co-jp" plus an unrelated ending. Whatever you enter, such as login ID, password, PIN or one-time codes, goes to the attacker, who can then access the account.

Note: this report is based on a short public post on X. The "How the scam works" section describes how this type of scam generally operates; it does not add details about this specific site beyond what the post says.

Source

kubotaa (@kubotaa3) on X, October 13, 2026.

Red flags

  • Domains that put the bank's name in front of an unusual ending like .digital or .best.
  • Texts or emails asking you to log in urgently to confirm or unlock your account.
  • Requests for both your password and one-time codes.

If you were targeted

  1. 1Do not enter a password, card number or one-time code on the page.
  2. 2If you already did, change that password right away (and anywhere you reused it), turn on two-step verification, and call your bank or card issuer if you entered payment details.
  3. 3Go to the real service by typing its address yourself or using its official app, not by following a link.
  4. 4Report the message to the impersonated company and to your national fraud or cybercrime reporting service.
ReportFraud.ftc.gov FBI IC3 More resources