www3-vpass[.]lqadg[.]cn

This domain, www3-vpass.lqadg.cn, operates as a credential phishing site targeting users of the VJA Group Vpass service. Analysis of the page title, 「重要】メンテナンスのお知らせ｜VJAグループ Vpass, indicates the domain impersonates official VJA Group communications to deceive users into entering sensitive login credentials under the pretense of system maintenance. The use of Japanese language and VJA Group branding suggests a targeted campaign against Japanese-speaking users, likely aiming to harvest credentials for financial fraud or identity theft. Infrastructure analysis reveals the domain was registered on May 17, 2025, through 商中在线科技股份有限公司, a registrar frequently associated with malicious domains. The domain resolves to IP address 172.67.141.142, hosted on AS13335 (Cloudflare, Inc.), a network commonly used to obfuscate malicious infrastructure. Detection metrics further confirm its malicious nature: the domain is flagged by 19 out of 95 security vendors on VirusTotal and appears on one security blocklist. Notably, the site lacks an SSL certificate, increasing the risk of credential interception during transmission. Users who visited www3-vpass.lqadg.cn or entered credentials on the site should immediately revoke any submitted login details through official VJA Group channels. It is recommended to change passwords for any accounts where the same credentials were reused and to enable multi-factor authentication where available. Affected users should monitor their accounts for unauthorized transactions and report any suspicious activity to their financial institution. System scans using updated security tools are advised to detect potential secondary infections or data exfiltration.