www3-vpass[.]htiyd[.]cn

The domain www3-vpass.htiyd.cn has been identified as a generic phishing threat. It masquerades as a legitimate notification for VJAグループ Vpass, a brand potentially targeted by this malicious activity. The domain is linked to a phishing campaign that aims to deceive users by imitating legitimate maintenance alerts. No specific drainer kit has been identified in association with this domain.

Technical analysis reveals several indicators of compromise. The domain is detected by 18 out of 95 security vendors on VirusTotal, highlighting its malicious nature. It was registered through 商中在线科技股份有限公司 and resolved to the IP address 2606:4700:3033::6815:447a, which is hosted in the United States under AS13335 (Cloudflare, Inc.). The domain was created on May 17, 2025, and does not have an SSL certificate. It appears on two security blocklists, specifically flagged by PhishDestroy and PhishingDB.

Currently, the domain www3-vpass.htiyd.cn is offline, reducing its immediate threat level. However, its prior activity suggests a need for continued vigilance. Organizations and users should ensure their security tools are updated to detect similar phishing attempts. Monitoring for any related domains or IP addresses is recommended to mitigate further risks. Security measures should be enforced to protect against potential data breaches or unauthorized access incidents that may arise from such phishing campaigns.