vpass-jp[.]yyt05[.]com

This domain, vpass-jp.yyt05.com, is currently flagged as an active phishing threat specializing in an Airdrop scam, according to multiple security sources. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on October 19, 2018, and resolves to the IP address 172.67.171.50. At present, security vendors have detected malicious indicators associated with this domain, with 16 out of 95 engines on VirusTotal identifying it as harmful. Additionally, the domain appears on two security blocklists and is explicitly labeled under the category of social engineering by Google Safe Browsing, reinforcing its classification as a high-risk threat. The page currently returns a 502 Bad Gateway error, which may indicate temporary technical issues or an attempt to evade detection while maintaining operational infrastructure. Despite this error, the domain remains active and continues to be monitored by security platforms. The presence of an Airdrop scam kit suggests the site is designed to deceive users into participating in fraudulent cryptocurrency or token giveaways, though the exact content and mechanics of the scam have not been fully analyzed due to the current unavailability of the page. Defenders should treat this domain as a confirmed threat and implement blocking measures at both the network and endpoint levels. Given its inclusion on multiple blocklists and consistent flagging by security vendors, organizations are advised to update their threat intelligence feeds to include vpass-jp.yyt05.com and its associated IP address. While the domain’s registration date predates the current scam activity, this is not uncommon for repurposed infrastructure. Further monitoring is recommended to track any changes in hosting or redirection behavior, as scammers frequently rotate domains and IPs to avoid detection.