vpass-jp[.]bletk[.]cn

The domain vpass-jp.bletk.cn has been identified as a generic phishing threat targeting users of Japanese payment portals. Analysis indicates this domain was actively used in credential harvesting campaigns before being taken offline. No specific brand name was confirmed in the impersonation attempt, though the subdomain structure suggests targeting of payment verification systems commonly used in Japan. Infrastructure analysis reveals the domain was flagged by 18 of 95 security vendors on VirusTotal, indicating moderate detection coverage. Registered on May 17, 2025, through 商中在线科技股份有限公司, the domain resolved to IP address 172.67.181.208, hosted on AS13335 Cloudflare infrastructure in the United States. The domain appears on one security blocklist and operated without an SSL certificate, increasing its detectability through basic network inspection. Creation date suggests recent deployment in active phishing operations. Current status shows the domain has been taken offline, though residual risk remains for systems that may have cached DNS records or users who interacted with the malicious site. Organizations should add vpass-jp.bletk.cn to internal blocklists and monitor for connections to 172.67.181.208. Network administrators are advised to review logs for any interactions with this domain between May 17 and its takedown date. Endpoint protection systems should be updated with these indicators of compromise, and user awareness training should emphasize verification of payment portal URLs, particularly those requesting sensitive financial information.