www3-vpass[.]oxhap[.]cn

This domain, www3-vpass.oxhap.cn, is identified as a credential phishing site designed to impersonate the VJA Group Vpass service. The page displays a fraudulent maintenance notice in Japanese, titled 「重要】メンテナンスのお知らせ｜VJAグループ Vpass, to deceive users into submitting login credentials or personal information. Such attacks typically harvest sensitive data for unauthorized access to financial accounts or identity theft, posing significant risks to individuals and organizations relying on legitimate VJA services. Analysis indicates the domain was registered on May 24, 2025, through 长沙小豆网络科技有限公司, a registrar based in China. It resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335) in the United States. The domain lacks an SSL certificate, increasing its detectability as malicious. Security vendors on VirusTotal have flagged this domain, with 17 out of 95 engines classifying it as phishing. Additionally, it appears on two security blocklists, further confirming its malicious nature. Users who visited www3-vpass.oxhap.cn should assume their credentials or personal information may have been compromised. Immediate actions include changing passwords for any accounts accessed after visiting the site, enabling multi-factor authentication where available, and monitoring financial statements for unauthorized transactions. If payment details were entered, contact financial institutions to report potential fraud. System scans using updated security tools are recommended to detect any secondary infections. Organizations should notify affected users and review access logs for signs of unauthorized activity linked to this phishing campaign.