whatsujs[.]cyou

Analysis of the domain whatsujs.cyou, observed as offline as of the report date 23 July 2026, indicates a targeted brand‑impersonation campaign against Rakuten. The domain was registered on 10 May 2025 through Gname.com Pte. Ltd. and is hosted on IP address 150.109.195.22, which resolves to a Japanese location associated with AS132203, a Tencent‑operated facility. No TLS certificate is presented, leaving the site exposed to interception if it were to become active. The HTTP response returns a page title in Japanese, "楽天会員 ログイン," directly referencing Rakuten’s member login portal, confirming the intent to mimic the brand’s authentication interface.

Multiple threat‑intel sources corroborate the malicious nature of the domain. AlienVault OTX records the domain in six separate pulses, and VirusTotal reports that 16 of 95 scanning engines flag the host as malicious, reinforcing the suspicion of phishing activity. The infrastructure bears a Gridinsoft trust score of 0 out of 100 and appears on at least one external security blocklist, indicating a high likelihood of abuse. Defensive services such as PhishDestroy have already blocked the domain, and the nameserver configuration (a.share-dns.com, a5.share-dns.com, b.share-dns.net, b5.share-dns.net) is typical of domains used for disposable or fast‑flux hosting.

While the site is currently offline, defenders should continue to monitor the IP address 150.109.195.22 for any reactivation or related sub‑domains, and enforce URL filtering rules that block any resolution to the listed nameservers. Email gateways should be updated to flag messages containing links to whatsujs.cyou, especially those purporting to request Rakuten credentials. Network security appliances should ingest the observed indicator set—domain name, IP, associated AS, and the lack of SSL—to enrich existing blocklists.