nq[.]jp-japanpost[.]com

The domain nq.jp-japanpost.com has been identified as a credential-harvesting phishing resource specifically targeting users of Japan Post services. Analysis confirms this domain operated under the generic_phishing threat classification, designed to impersonate official postal communications to extract sensitive login credentials or personal information. As of the latest verification, the domain has been taken offline, though residual risks may persist through cached or distributed attack vectors. Infrastructure analysis reveals the domain was registered through Global Domain Group LLC on November 28, 2025, with no SSL certificate implemented, increasing exposure to interception risks. It resolved to the IP address 45.192.170.145, hosted under AS138995 (Antbox Networks Limited) in Hong Kong, a network segment frequently associated with transient malicious activity. Detection metrics indicate the domain was flagged by 15 of 95 security vendors on VirusTotal, while appearing on a single blocklist maintained by an independent threat intelligence provider. The absence of encryption, combined with the domain's recent creation and low detection count, suggests a targeted campaign with limited initial visibility. Current status confirms the domain is no longer resolving, though historical artifacts may remain in threat intelligence repositories or local caches. Organizations are advised to update web filtering rules to explicitly block the domain and its associated IP address (45.192.170.145) at the perimeter. Users who may have interacted with the domain should initiate credential rotation for any accounts linked to Japan Post services, particularly if login attempts were made. Security teams should monitor for related infrastructure, including domains registered through the same registrar (Global Domain Group LLC) or hosted on the same autonomous system (AS138995), as these may indicate follow-on campaigns.