www3-vpass-jp[.]ymtzhcc[.]com

This domain is flagged as a high-risk credential theft operation impersonating Vpass, a payment authentication service under the VJA group. The site displays a fraudulent maintenance notice to deceive users into entering login credentials, which are then harvested for unauthorized account access or financial fraud. Analysis indicates this is not a generic phishing attempt but a targeted brand impersonation attack against Vpass customers. Infrastructure analysis reveals multiple technical indicators of compromise. The domain www3-vpass-jp.ymtzhcc.com was registered on July 24, 2021, through Gname.com Pte. Ltd., and currently resolves to IP address 172.67.216.25, hosted on Cloudflare's network (AS13335). No SSL certificate is present, increasing the risk of data interception. VirusTotal detection shows 15 out of 95 security vendors flagging this domain as malicious, while it appears on one security blocklist. The page title, 『重要】メンテナンスのお知らせ｜VJAグループ Vpass, mimics legitimate Vpass communications to enhance credibility. Mitigation requires immediate action from both users and network defenders. Users who accessed this domain should assume credential compromise and initiate password resets for all accounts where the same credentials were used, particularly financial services. Network administrators should block the domain and IP address 172.67.216.25 at the perimeter, and monitor for connections to this infrastructure. Organizations should implement DMARC, SPF, and DKIM to prevent similar brand impersonation attacks. Security teams should treat any credentials submitted through this domain as compromised and investigate potential follow-on activity in authentication logs.