ccfff[.]cyou

Analysis of ccfff.cyou indicates a confirmed brand impersonation phishing domain targeting Rakuten, as evidenced by the page title '楽天会員 ログイン' (Rakuten Member Login) and explicit classification in threat intelligence sources. The domain was registered on September 28, 2025, through Gname.com Pte. Ltd., and resolves to IP 150.109.195.22, hosted on AS132203 (Tencent Building, Kejizhongyi Avenue, JP). No SSL certificate is present, increasing the risk of credential interception over unencrypted connections. The domain appears on one security blocklist (PhishDestroy) and is flagged by 15 of 95 security vendors on VirusTotal, confirming detection as malicious.

AlienVault OTX records the domain in 16 threat intelligence pulses, suggesting active tracking by defenders. Infrastructure analysis reveals the use of shared DNS providers (a.share-dns.com, a4.share-dns.com, b.share-dns.net, b4.share-dns.net), a common tactic in phishing campaigns to evade takedowns. As of July 23, 2026, the domain is offline, but defenders should treat it as a historical threat.

The Gridinsoft trust score of 0/100 further corroborates its malicious classification. While the exact phishing kit or payload is not confirmed in available data, the combination of brand impersonation, lack of encryption, and detection by multiple vendors warrants blocking at the DNS and proxy levels. Security teams should monitor for related domains using the same nameservers or IP range, as these may indicate follow-up campaigns.