wwjjj[.]cyou

The domain wwjjj.cyou was registered on September 29, 2025 through Gname.com Pte. Ltd. and currently resolves to the IP address 43.165.185.60, which is hosted in Japan under ASN 132203 at a Tencent building. No SSL certificate was observed for the host, indicating that any traffic would be transmitted over clear‑text HTTP. The site’s page title, "楽天会員 ログイン," directly references the Rakuten member login portal, confirming a brand‑impersonation intent toward Rakuten customers. VirusTotal scans returned 16 positive detections out of 95 security vendors, reflecting a moderate consensus among analysis engines that the domain is malicious.

Additional threat intelligence from AlienVault OTX shows the domain appearing in five separate pulses, and PhishDestroy has added it to its blocklist. Gridinsoft assigned a trust score of 0 out of 100, and the domain is listed on a separate security blocklist, reinforcing its classification as a high‑confidence phishing resource. The domain’s authoritative nameservers are a.share-dns.com, a8.share-dns.com, b.share-dns.net, and b8.share-dns.net, which are commonly associated with disposable or fast‑flux hosting services.

The site has been taken offline, but its prior activity suggests it was used to harvest credentials from unsuspecting Rakuten users. Defenders should continue to block wwjjj.cyou at perimeter and DNS layers, monitor for any residual malicious payloads that may have been delivered through the site, and advise end‑users to verify the authenticity of Rakuten login pages, especially when encountering unexpected requests for credentials. Ongoing observation of the associated IP range and nameserver infrastructure is recommended to detect potential re‑hosting of the phishing kit.