oolll[.]cyou

Analysis of the domain oolll.cyou indicates a targeted brand‑impersonation campaign aimed at Rakuten. The domain was registered on 30 September 2025 through Gname.com Pte. Ltd. and is hosted on IP address 150.109.195.22, which resolves to a Japanese location in the AS132203 network associated with a Tencent building. No SSL certificate is presented, implying that any communication would occur over plain HTTP. The site’s HTML title is the Japanese phrase “楽天会員 ログイン”, directly referencing the Rakuten member login portal, confirming the intended brand abuse.

Threat‑intelligence aggregation shows the domain appears on a single security blocklist and is specifically listed by PhishDestroy as blocked. In the Open Threat Exchange, the domain is referenced in sixteen distinct pulses, indicating moderate propagation among analyst communities. VirusTotal scans have resulted in fifteen of ninety‑five security vendors flagging the domain as malicious, reinforcing the suspicion of illicit use. The Gridinsoft trust score of 0 out of 100 provides an additional low‑reputation indicator.

Nameserver configuration uses shared DNS services (a.share-dns.com, a7.share-dns.com, b.share-dns.net, b7.share-dns.net), a pattern often observed in disposable or fast‑flux infrastructures. The current offline status prevents live HTTP verification, so the exact content beyond the title cannot be confirmed. Defenders should add the domain to denylists, block traffic to its resolved IP, and monitor for similar registrations using the same registrar or naming patterns. Continuous re‑evaluation is advised in case the site returns online or additional detection data emerges.