whatscart[.]cyou

This domain, whatscart.cyou, poses a direct threat to users by impersonating Rakuten, a major Japanese e-commerce platform, to harvest login credentials. The site displays a fraudulent login page titled 楽天会員 ログイン, designed to mimic the legitimate Rakuten member portal. Victims who enter their credentials risk unauthorized account access, financial fraud, and identity theft, as stolen credentials are often sold or exploited for further malicious activity. Analysis indicates this domain is a confirmed credential theft operation. It was registered on February 21, 2026, through Gname.com Pte. Ltd., an uncommon registrar for legitimate business domains. The domain resolves to IP address 172.67.149.107, hosted on Cloudflare’s infrastructure (AS13335), which is frequently abused by threat actors to conceal their true origin. Security vendors have flagged this domain, with 17 out of 95 engines on VirusTotal detecting malicious activity. Additionally, it appears on two security blocklists, including PhishDestroy and PhishingDB, further confirming its fraudulent nature. The SSL certificate, issued by WE1, is a low-assurance provider often associated with ephemeral phishing campaigns. Users who visited whatscart.cyou should take immediate action to mitigate risks. First, change the passwords for any accounts entered on the site, prioritizing financial and email accounts. Enable multi-factor authentication (MFA) where available to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized transactions or login attempts from unfamiliar locations. If financial information was entered, contact the relevant institution to report potential fraud and request account monitoring. Additionally, scan devices used to access the site for malware, as some phishing pages may deliver secondary payloads. Finally, report the domain to local cybersecurity authorities or consumer protection agencies to aid in takedown efforts and prevent further victimization.