whatsqrh[.]cyou

The domain whatsqrh.cyou impersonates Rakuten, a well-known e-commerce platform, to conduct phishing attacks. Despite its takedown, it was flagged by 16 out of 95 vendors on VirusTotal, indicating a significant threat before it went offline. The page title, 楽天会員 ログイン, suggests it targeted Japanese-speaking users by mimicking Rakuten's login page.

Registered through Gname.com Pte. Ltd., the domain was hosted on an IP address located in Japan under ASN AS132203, associated with Tencent Building. The absence of an SSL certificate might have made it easier for vigilant users to detect the scam, but the domain's presence on public blocklists like PhishDestroy and PhishingDB highlights its malicious intent.

PhishDestroy identified the domain on November 6, 2025, shortly after its creation in May 2025. The quick detection underscores the importance of early threat identification, as phishing domains often exploit the time lag between registration and antivirus database updates. This case exemplifies how phishing operations can be rapidly deployed and taken down, yet still pose a risk during their active period. The swift takedown of whatsqrh.cyou demonstrates effective collaboration between cybersecurity entities and domain registrars.