www3-vpass-jp[.]jzny1681[.]com

This domain, www3-vpass-jp.jzny1681.com, is identified as a credential theft operation targeting users of the VJA Group Vpass service. The phishing page displays a fraudulent maintenance notification titled 「重要】メンテナンスのお知らせ｜VJAグループ Vpass, designed to deceive Japanese-speaking victims into submitting login credentials. No cryptocurrency drainer kit signatures were detected in initial analysis, though credential harvesting remains the primary objective. The page mimics legitimate VJA Group branding, including logos and formatting consistent with official communications, increasing the likelihood of successful social engineering. Infrastructure analysis reveals the domain resolves to IP address 172.67.153.124 and was registered through NameSilo, LLC on December 13, 2014. Detection metrics show 15 out of 95 security vendors on VirusTotal flagging the domain as malicious. Google Safe Browsing classifies this as SOCIAL_ENGINEERING, while two independent security blocklists have added the domain to their denylists. The domain's creation date predates the observed malicious activity, suggesting either compromise of an older, previously legitimate domain or strategic registration to evade suspicion. The domain is currently offline, having been taken down following detection. While this removes immediate access to the phishing page, residual risk persists through potential credential reuse by victims. Users who interacted with the site are advised to reset credentials for any accounts accessed during the exposure window, particularly those associated with VJA Group services. Organizations should monitor for compromised credentials in credential stuffing attempts and consider implementing additional authentication factors for sensitive accounts. The domain's presence on multiple blocklists indicates continued monitoring is warranted should it reappear under altered infrastructure.