www3-vpass[.]hnbngdh[.]com

Analysis of www3-vpass.hnbngdh.com indicates a high‑risk generic phishing campaign targeting users of the VJA Group Vpass service. The domain was first registered on August 01, 2023 through Gname.com Pte. Ltd. and is currently hosted behind Cloudflare infrastructure (AS13335) with the IP address 104.21.53.232 located in the United States. The site presents a page title of 【重要】メンテナンスのお知らせ｜VJAグループ Vpass, suggesting an attempt to masquerade as an official maintenance notice from the VJA Group Vpass portal. The domain lacks an SSL certificate and returns an HTTP 403 status, yet it remains active and continues to resolve to the Cloudflare‑protected IP. Reputation data shows the domain receives a Gridinsoft trust score of 0 out of 100 and is flagged by 15 of 95 security vendors on VirusTotal, reflecting a consensus of malicious intent. It has been listed on a single security blocklist and is actively blocked by the PhishDestroy feed. The nameservers harley.ns.cloudflare.com and mariah.ns.cloudflare.com further confirm the use of Cloudflare’s DNS services, a common tactic for threat actors seeking to hide true infrastructure. These indicators collectively reinforce the classification of the domain as a phishing vector aimed at credential harvesting or unauthorized access to VJA Group Vpass accounts. Defenders should add www3-vpass.hnbngdh.com to network and endpoint blocklists, enforce TLS inspection to capture the unencrypted HTTP traffic, and monitor DNS queries for the associated Cloudflare nameservers. Security teams are advised to alert users about the fraudulent maintenance notice and to verify any unexpected communications from VJA Group Vpass through official channels. Continuous threat‑intel feeds should be consulted for updates, as additional indicators may emerge as the campaign evolves.