1vsfo5jbq6[.]cyou

Analysis of 1vsfo5jbq6.cyou shows a confirmed Rakuten brand‑impersonation site that was taken offline prior to the report date. The authoritative name servers are rayden.ns.cloudflare.com and zoe.ns.cloudflare.com, indicating the domain is hosted behind Cloudflare’s network (AS13335). DNS resolution points to IP 172.67.135.245, a Cloudflare edge node located in the United States. No TLS certificate is present, meaning the site served HTTP only. The page title returned by the server is "楽天会員 ログイン", which matches the targeted brand and suggests a login‑credential harvesting page.

Registration records reveal the domain was created on 14 January 2025 through Gname.com Pte. Ltd., and the registrar information has not been altered since creation. Reputation services assign a trust score of 1/100 on ScamAdviser and 0/100 on Gridinsoft, reflecting extremely low credibility. VirusTotal scans flagged the domain in 16 of 95 engines, and AlienVault OTX lists it in one threat‑intel pulse, indicating that multiple security vendors have observed malicious activity. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy sinkhole service.

Current HTTP status is offline, but the historical indicators confirm that the domain was used to impersonate Rakuten and lure users to submit credentials. Uncertainty remains regarding the exact phishing kit employed and whether additional payloads were delivered, as no further forensic evidence is publicly available. Defenders should immediately add 1vsfo5jbq6.cyou to URL filtering and DNS block lists, monitor for new domains registered with the same registrar or using similar Cloudflare name servers, and enforce multi‑factor authentication for any Rakuten‑related accounts. Continuous threat‑intel feeds should be consulted for any resurgence of this indicator.