vpass-jp[.]olawt[.]cn

This domain, vpass-jp.olawt.cn, is flagged as a generic phishing site designed to impersonate a VPN authentication portal. Analysis indicates it targets users attempting to access corporate or personal VPN services, likely harvesting login credentials through fraudulent input forms. No specific brand impersonation or drainer kit signatures have been confirmed, though the subdomain structure suggests an intent to mimic legitimate Japanese VPN endpoints. Infrastructure analysis reveals the domain was registered on May 17, 2025, through 商中在线科技股份有限公司, a registrar commonly associated with short-lived malicious domains. It resolves to IP 172.67.196.202, hosted on AS13335 (Cloudflare, Inc.), despite lacking an SSL certificate. VirusTotal detection shows 17 out of 95 security vendors flagging the domain as malicious. The domain appears on two security blocklists and is currently returning a 502 Bad Gateway error, indicating takedown or backend failure. Current status is offline, though residual risk persists due to the domain's recent creation and Cloudflare IP usage, which may facilitate rapid redeployment. Response actions should include monitoring for DNS reactivation, blocking the IP at perimeter defenses, and alerting users to potential credential exposure. The absence of SSL and presence on multiple blocklists reinforce its classification as an elevated-risk threat, warranting continued scrutiny even while inactive.