vpass-jp[.]woimport[.]com

Analysis indicates that the domain vpass-jp.woimport.com is actively serving a phishing page targeting users of the VJA Group Vpass service. The page title, retrieved from HTTP headers, reads '【重要】メンテナンスのお知らせ｜VJAグループ Vpass', which translates to an urgent maintenance notice for Vpass, a known Japanese payment and authentication platform. This strongly suggests an attempt to deceive users into entering credentials or personal information under the guise of a system update. Infrastructure analysis reveals the domain resolves to IP address 172.67.197.159, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain is currently active, returning an HTTP 200 status, and is served via Cloudflare nameservers (cleo.ns.cloudflare.com and rosalie.ns.cloudflare.com). No SSL certificate is present, increasing the likelihood of interception or manipulation of user-submitted data. The domain was registered on November 3, 2017, through Gname.com Pte. Ltd., though the registration age does not correlate with legitimacy in this context. Security vendor data shows the domain is flagged by 14 of 95 engines on VirusTotal, and it appears on two independent security blocklists (PhishDestroy and PhishingDB). The Gridinsoft trust score is 0/100, further corroborating its malicious classification. While the exact phishing kit or backend infrastructure remains unconfirmed, the combination of the page title, active status, and blocklist presence confirms the domain is operating as a high-risk phishing site. Defenders should treat this domain as actively malicious and prioritize blocking it at the DNS, proxy, or network level. Users encountering this domain should be advised not to interact with it, particularly if prompted for credentials or financial information. Additional monitoring of related subdomains or IPs within the same Cloudflare ASN may reveal further malicious activity.