Researcher flags zenithal.cfd phishing site impersonating JCB card
@masaomi346 reported on X on 3 November 2026 that zenithal.cfd is a phishing site imitating the JCB card company's MyJCB login page. The post does not say how victims reach it or whether anyone has lost money.
- First reported
- Reports
- 1
Source: x.com · published
What happened
Japanese security researcher @masaomi346 posted on X on 3 November 2026 about a phishing site that imitates JCB, the Japanese card company. The post gives the address as hxxps://zenithal.cfd/dsfdsgad/#/index, tagged #Phishing and #フィッシング詐欺 (phishing fraud). zenithal.cfd is not a JCB domain, and the post does not say how victims are reached or whether anyone has lost money.
How the scam works
The phone screenshot in the post shows a page headed “MyJCBにようこそ” (Welcome to MyJCB) with the MyJCB logo and a customer-support button. Two red notices near the top mention the Android MyJCB app and ask visitors to beware of phishing fraud that pretends to be JCB, so the page copies the real service's own warning. Below that is a blue box for people already registered, with empty fields for a MyJCB ID and a MyJCB password and a tick box to show the password. The browser address bar at the bottom reads zenithal.cfd.
A login page like this is the usual last step of a card-company phishing message. A text or email says that a card has been suspended or a payment needs confirming, and the link leads to a copy of the member site. Anything typed into the form goes to the operators, who can then try the credentials on the real site, intercept one-time codes or use stolen card details for purchases. The researcher's post does not describe the message that leads to the page, and the exact path and the use of a .cfd domain are the only technical indicators it lists. Pages of this kind are often short-lived, so the site may already be down.
Source
@masaomi346 on X, post of 3 November 2026 (address and screenshot). Not independently verified by scammers.com.
Red flags
- A MyJCB login page on the unrelated domain zenithal.cfd.
- A page that copies JCB's own scam notices to look more trustworthy.
- A login form reached from an unexpected text or email about a card problem.
- An unusual web path (/dsfdsgad/#/index) on a cheap .cfd domain.
If you were targeted
- 1Do not enter your MyJCB ID or password on zenithal.cfd.
- 2Log in to MyJCB only through the official app or an address you typed or bookmarked yourself.
- 3If you entered details, change your password at once and contact JCB using the number on your card.
- 4Check your card statement for purchases you did not make and report them to the card company.
- 5Report suspicious messages to JCB and, in Japan, to the police cybercrime consultation service.