vpass-jp[.]cjtri[.]cn

This domain, vpass-jp.cjtri.cn, poses as an official maintenance notice page for VJA Group Vpass, a Japanese credit card association. The site is designed to harvest login credentials from unsuspecting users by displaying a fake security alert in Japanese, urging immediate action. Once credentials are entered, attackers gain access to financial accounts, enabling unauthorized transactions or identity theft. Analysis indicates the domain was registered on May 17, 2025, through 商中在线科技股份有限公司, a registrar frequently associated with malicious infrastructure. It resolves to IP address 172.67.154.201, hosted on Cloudflare’s network (AS13335). The SSL certificate, issued by TrustAsia Technologies, Inc. under LiteSSL RSA CA 2025, adds a superficial layer of legitimacy. Security vendors on VirusTotal flagged the domain, with 17 out of 95 detecting it as malicious. It also appears on two security blocklists, including PhishDestroy and PhishingDB. If you visited vpass-jp.cjtri.cn or entered credentials, take immediate action. Disconnect the device from the network to prevent further data exfiltration. Change passwords for all financial accounts, especially those linked to VJA or Vpass services, using a separate, secure device. Enable multi-factor authentication where available. Monitor bank and credit card statements for unauthorized transactions and report any suspicious activity to your financial institution. Consider contacting local cybersecurity authorities to report the incident and seek further guidance.