qrtn[.]jp

Analysis of qrtn.jp indicates a high-risk phishing domain targeting users through QR code and URL shortening services under the guise of KADOKAWA, a known Japanese media brand. The domain was registered on February 21, 2026, and remains active as of July 12, 2026. It resolves to IP 52.199.127.131 (AS16509, Amazon.com, Inc., located in Japan) and employs Cloudflare for hosting, alongside Amazon Web Services infrastructure. The page title explicitly references KADOKAWA's QR code and short URL service, suggesting an attempt to impersonate or misuse the brand's identity. Technical indicators reveal the domain is flagged by 2 security blocklists and appears in 2 AlienVault OTX threat intelligence pulses, reinforcing its malicious classification. One of 93 security vendors on VirusTotal has detected the domain as malicious, though the limited detection rate does not diminish its risk given corroborating evidence. The domain uses a 301 HTTP redirect, a common tactic to obscure final destinations or distribute malicious payloads. SSL certification is provided by Amazon RSA 2048 M02, a standard but not inherently trustworthy certificate authority in this context. Defenders should treat qrtn.jp as an active threat. Block the domain and its resolving IP at perimeter security controls. Monitor for connections to 52.199.127.131 or attempts to access the domain, particularly in environments where QR code or URL shortening services are utilized. The exact phishing mechanism remains unconfirmed due to lack of detailed page analysis, but the combination of brand impersonation, recent registration, and security vendor detections justifies immediate containment. No evidence suggests this domain is legitimate or safe for user interaction.