www3-vpass[.]lifqh[.]cn

This domain, www3-vpass.lifqh.cn, has been identified as a generic phishing threat and is currently offline. Analysis indicates that it impersonated the VJA Group Vpass service, using the page title "【重要】メンテナンスのお知らせ｜VJAグループ Vpass" to imitate a legitimate maintenance notification. The infrastructure is no longer accessible, indicating that the malicious content has been taken offline; however, historical indicators remain relevant for incident response, retrospective investigations, and threat hunting.

Technical analysis shows that the domain resolved to IP address 188.114.96.3, located in the United States within AS13335 Cloudflare, Inc. The domain was created on May 04, 2025 and registered through 商中在线科技股份有限公司. It appears on 1 security blocklist and is flagged by 17 of 95 VirusTotal security vendors, supporting its classification as a malicious phishing resource. No SSL certificate was present at the time of assessment, further reducing infrastructure trustworthiness. The combination of recent registration, brand impersonation, blocklist inclusion, and multi-vendor detections represents an elevated risk profile.

The current status indicates that the domain has been taken offline, reducing the immediate likelihood of successful phishing through this specific host. Despite this, historical compromise indicators should be retained because similar infrastructure may be reactivated or replicated under related domains. Security teams should maintain blocking rules for the domain, monitor DNS and proxy logs for previous connections, review authentication events associated with potential credential exposure, and update detection signatures with the observed indicators, including the domain name, IP address, page title, and registration metadata. Continued monitoring for lookalike domains using comparable naming patterns is recommended.