public company · US

Sumitomo Mitsui Banking Corporation

SUMITOMO MITSUI FINANCIAL GROUP, INC.

Japanese bank.

Primary official domain
smbc.co.jp
Reviewed official domains
3 (directory review; organization has not verified)
Directory source
BreachScout directory · Suggest a correction
Matching domains, 30 days
0
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
16
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF ~all · 2/10 lookups · checked 2026-10-18 · published policy

What we watch for

Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.

Brand tokens
sumitomosmbccard
Label aliases
Sumitomo Mitsui Banking Corporation · smbc-card · SMBC
Official domains
smfg.co.jp · smbc.co.jp · smbc-card.com (all)
Generated spellings
400 tracked · 0 observed somewhere · 400 not observed (all)

Official domains and email policies

Domains reviewed as belonging to Sumitomo Mitsui Banking Corporation. DMARC helps receivers check the From domain; lookalike domains remain possible. Published policies cannot confirm actual mail configuration or receiver behavior.

DomainRelationshipEvidenceDMARC policyPolicy sourceSPFReportingLast check
smfg.co.jp
primaryReviewed —
Portfolio directory (wikidata_cik+financedb_ticker)rejectDirect~all · 2/10 lookupsAggregate reports requested (rua)2026-10-18 22:03 UTC
Records and check details

Published records

DMARC (_dmarc.smfg.co.jp)
v=DMARC1;p=reject;pct=100;fo=1;ri=86400;rua=mailto:…@report.securemx.jp
SPF (smfg.co.jp)
v=spf1 +include:spf.securemx.jp +include:spf.smbc.co.jp ~all
DKIM
Unknown (no known selector). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing.

Interpretation

  • p=reject: receivers are asked to reject failing mail.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • pct=100 is a legacy tag removed by RFC 9989; its effect is receiver-dependent.
  • ri is a legacy tag removed by RFC 9989.
  • ~all (softfail): unlisted hosts are marked suspicious; this is not +all and does not by itself bypass DMARC.
  • 2 DNS-querying terms (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Checked with an earlier assessment that did not validate IP mechanism syntax or resolve a/mx/exists targets; it is re-assessed on the next check.

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.smfg.co.jp: ok, 1 DMARC record

Recent checks

  • 2026-10-18 22:03 UTC: DMARC reject; SPF ~all

Assessment posture-v1. DNS lookup failures leave the policy unknown.

smbc.co.jp
primaryReviewed 2026-10-18
DomainSpoof directory (seed)rejectDirect~all · 2/10 lookupsAggregate reports requested (rua)2026-10-18 22:03 UTC
Records and check details

Published records

DMARC (_dmarc.smbc.co.jp)
v=DMARC1;p=reject;pct=100;fo=1;ri=86400;rua=mailto:…@report.securemx.jp
SPF (smbc.co.jp)
v=spf1 +ip4:202.221.2.64/26 +ip4:202.221.246.192/27 +ip4:202.221.255.64/26 +ip4:210.148.15.0/26 +include:spf.securemx.jp +include:spf.smbc.co.jp ~all
DKIM
Unknown (no known selector). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing.

Interpretation

  • p=reject: receivers are asked to reject failing mail.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • pct=100 is a legacy tag removed by RFC 9989; its effect is receiver-dependent.
  • ri is a legacy tag removed by RFC 9989.
  • ~all (softfail): unlisted hosts are marked suspicious; this is not +all and does not by itself bypass DMARC.
  • 2 DNS-querying terms (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Checked with an earlier assessment that did not validate IP mechanism syntax or resolve a/mx/exists targets; it is re-assessed on the next check.

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.smbc.co.jp: ok, 1 DMARC record

Recent checks

  • 2026-10-18 22:03 UTC: DMARC reject; SPF ~all

Assessment posture-v1. DNS lookup failures leave the policy unknown.

smbc-card.com
subsidiaryReviewed 2026-10-18
DomainSpoof directory (seed)rejectDirect~all · 6/10 lookupsAggregate reports requested (rua)2026-10-18 22:03 UTC
Records and check details

Published records

DMARC (_dmarc.smbc-card.com)
v=DMARC1; p=reject; sp=quarantine; rua=mailto:…@dmarc25.jp,mailto:…@report.securemx.jp
SPF (smbc-card.com)
v=spf1 redirect=smbc-card.com.r.spf25.jp
DKIM
Unknown (no known selector). DKIM use requires a known selector or message to assess; a published key alone cannot confirm signing.

Interpretation

  • p=reject: receivers are asked to reject failing mail.
  • Subdomain policy sp=quarantine differs from p=reject.
  • Relaxed DKIM alignment (default).
  • Relaxed SPF alignment (default).
  • ~all (softfail): unlisted hosts are marked suspicious; this is not +all and does not by itself bypass DMARC.
  • 6 DNS-querying terms (include, a, mx, ptr, exists, redirect), counted recursively; the limit is 10.
  • Checked with an earlier assessment that did not validate IP mechanism syntax or resolve a/mx/exists targets; it is re-assessed on the next check.

Observations

  • DMARC: Weaker subdomain exception: sp=quarantine is weaker than p=reject

DMARC discovery (RFC 9989 tree walk)

  1. _dmarc.smbc-card.com: ok, 1 DMARC record

Recent checks

  • 2026-10-18 22:03 UTC: DMARC reject; SPF ~all

Assessment posture-v1. DNS lookup failures leave the policy unknown.

“Not checked”: no check yet. “Lookup failed”: DNS result unknown. Report mailbox names are redacted.

Reports on official domains appear under “Official assets with reports” on the Reported matches tab.