v-vpass-jp[.]gzjbf[.]com

The domain v-vpass-jp.gzjbf.com was identified as a brand impersonation phishing site targeting VJA Group's Vpass service, specifically designed to harvest user credentials under the guise of a maintenance notification. The domain is currently offline, but its malicious intent was clear from its title and structure. This threat type is credential theft, as the site mimics the legitimate Vpass login page to deceive users into entering sensitive information.

PhishDestroy's analysis reveals that v-vpass-jp.gzjbf.com was registered through Gname.com Pte. Ltd. on September 02, 2023, and resolved to the IP address 2606:4700:3030::6815:49e1. It lacks an SSL certificate, a red flag for a site handling credentials. VirusTotal data shows that 17 out of 95 security vendors flagged this domain as malicious, and it appears on 2 security blocklists. These indicators collectively point to a high-risk phishing operation that could have led to significant credential compromise.

Given that the domain is now offline, the immediate risk is mitigated, but users who may have encountered it should change their Vpass passwords immediately and enable two-factor authentication. PhishDestroy recommends continuous monitoring for similar domains and reporting any suspicious login attempts to VJA Group's security team. Organizations should also educate users about verifying URLs and avoiding unsolicited maintenance notifications.