whatsoen[.]cyou

This domain, whatsoen.cyou, poses a direct threat as a credential theft operation targeting Rakuten customers. Analysis of the infrastructure reveals a Japanese-language login page titled "楽天会員 ログイン," designed to harvest user credentials by mimicking the legitimate Rakuten authentication portal. The domain specifically targets Japanese-speaking users, increasing the risk of successful compromise for individuals attempting to access their accounts through this fraudulent interface. Infrastructure analysis provides concrete evidence of malicious intent. The domain was registered on June 12, 2025, through Gname.com Pte. Ltd., and currently resolves to the IP address 188.114.97.3, hosted on Cloudflare infrastructure (AS13335). Security vendors have flagged the domain in 18 out of 95 VirusTotal scans, and it appears on one security blocklist. Notably, the domain lacks an SSL certificate, a critical security indicator that legitimate financial services would never omit, further confirming its fraudulent nature. Users who visited whatsoen.cyou should immediately take protective measures. Any credentials entered on this site must be considered compromised and should be changed from a secure device. Enable multi-factor authentication on all financial accounts, particularly Rakuten, to prevent unauthorized access. Monitor account statements for suspicious transactions and report any unauthorized activity to the legitimate service provider. If personal or financial information was submitted, consider placing a fraud alert on credit files to prevent identity theft. This domain has been taken offline, but similar threats may emerge using comparable infrastructure patterns.