Researcher flags r6j3hjp.shop phishing site impersonating Rakuten
Researcher @masaomi346 says r6j3hjp.shop is a phishing site impersonating Rakuten, showing an account information confirmation page built to collect login details.
- First reported
- Reports
- 1
Source: x.com · published
What happened
On 4 November 2026 the security researcher @masaomi346 posted on X that r6j3hjp.shop was a phishing site impersonating Rakuten, the Japanese e-commerce and financial services group. A screenshot attached to the post shows a page in Rakuten's style headed with a confirmation of account information, with the browser address bar showing r6j3hjp.shop instead of a rakuten.co.jp address. The domain is a short string of random characters on the .shop top-level domain, a pattern common in phishing campaigns that rotate through many throwaway domains.
How the scam works
Rakuten phishing in Japan typically arrives as an email or SMS saying that the account has been restricted, that a payment failed, or that the user's details need to be confirmed. The link leads to a page that copies Rakuten's layout and asks for the Rakuten ID and password, and then often for card number, expiry date and security code, name, date of birth and address. Some versions also ask for the one-time code sent by the card issuer, which lets the criminals approve a purchase in real time.
Details entered on such pages can be used to take over the Rakuten account, to spend Rakuten points, or to make purchases with the stored or entered card. The researcher's post did not describe the full flow of this page beyond the account confirmation screen shown. Rakuten tells customers to check notices by opening the Rakuten app or typing the official address, and to be suspicious of messages that create urgency about an account being suspended. Anyone who has entered details should change their Rakuten password, review recent orders and points, and contact their card issuer to block the card if card details were typed in. The domain comes from the researcher's post and has not been independently checked by scammers.com.
Source
Post by @masaomi346 on X, 4 November 2026 (2:55 AM ET), with a screenshot of the page. Not independently verified by scammers.com.
Red flags
- A Rakuten account check page on a domain that is not rakuten.co.jp.
- A random-looking domain such as r6j3hjp.shop.
- Messages saying the account is restricted unless details are confirmed.
- Requests for card details and one-time codes after the login.
- Pressure to act within hours.
If you were targeted
- 1Do not enter passwords, card numbers or one-time codes on a page reached from a text, email or ad.
- 2Open the company's official app or type its address yourself to check your account.
- 3If you entered details, change your password at once and contact the company through its official channels.
- 4Report the message and the link to the company and to your national phishing reporting service.
- 5Delete the message without replying or tapping any links.