vpass-jp[.]leakm[.]cn

This domain, vpass-jp.leakm.cn, is identified as a phishing site designed to impersonate Vpass, a service associated with the VJA Group in Japan. The page displays a fraudulent maintenance notice in Japanese, titled 「重要】メンテナンスのお知らせ｜VJAグループ Vpass, which is intended to deceive users into entering sensitive credentials under the guise of a legitimate system update. Such tactics are commonly used to harvest login details, financial information, or personal data for unauthorized access or fraudulent transactions. The site specifically targets Japanese-speaking users, leveraging the trust associated with the Vpass brand to increase the likelihood of successful deception. Analysis indicates that the domain was registered on May 17, 2025, through the registrar 商中在线科技股份有限公司, a provider frequently observed in phishing infrastructure. The domain resolves to the IP address 172.67.223.32, hosted on Cloudflare's network (AS13335), which is often exploited to obfuscate the true origin of malicious sites. As of the latest assessment, the domain is flagged by 18 out of 95 security vendors on VirusTotal, with detections from sources such as PhishDestroy and PhishingDB. Additionally, the domain appears on two independent security blocklists, further corroborating its malicious nature. The SSL certificate, issued by Let's Encrypt, does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. Users who have visited vpass-jp.leakm.cn or entered any information on the site should take immediate action to mitigate potential risks. First, cease all interaction with the domain and avoid clicking any links or downloading files from it. If credentials were submitted, change passwords for the affected account and any other services where the same credentials may have been reused. Enable multi-factor authentication where available to add an additional layer of security. Monitor financial statements and account activity for unauthorized transactions, and report any suspicious activity to the relevant financial institution or service provider. Additionally, consider running a security scan on the device used to access the site to detect any potential malware or unauthorized access.