vpass-jp[.]lqadg[.]cn

This domain, vpass-jp.lqadg.cn, operates as a phishing site impersonating the VJA Group Vpass service, a widely recognized Japanese payment and credit card platform. The page displays a fraudulent maintenance notice titled 「重要】メンテナンスのお知らせ｜VJAグループ Vpass, designed to deceive users into entering sensitive credentials, including login details and financial information. Analysis indicates the site employs social engineering tactics typical of credential harvesting campaigns, leveraging urgency and brand trust to manipulate victims. The absence of an SSL certificate further increases exposure risk, as data transmitted to the domain is unencrypted and vulnerable to interception. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on May 17, 2025, through 商中在线科技股份有限公司, a registrar frequently associated with phishing and fraudulent domains. Security vendor detections on VirusTotal stand at 17 out of 95, with the domain blocked by PhishDestroy and PhishingDB and appearing on two independent security blocklists. The domain resolves to IP address 172.67.141.142, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic used to conceal origin infrastructure and evade takedown efforts. Despite being currently offline, historical activity and registration patterns suggest potential for reactivation under similar or altered infrastructure. Users who accessed vpass-jp.lqadg.cn or entered credentials on the site should take immediate remediation steps. All exposed login credentials should be considered compromised and changed across all platforms where identical or similar passwords were used. Financial institutions should be notified to monitor for unauthorized transactions, and credit reports should be reviewed for signs of identity misuse. Devices used to access the site should undergo malware scanning, as phishing pages may deploy secondary payloads or browser-based exploits. Organizations are advised to update internal blocklists with the domain and associated IP, and to alert employees or customers to the specific threat, particularly those within Japanese-speaking regions or with ties to VJA Group services.