www3-vpass[.]omsgx[.]cn

This domain, www3-vpass.omsgx.cn, is identified as a credential phishing site impersonating the VJA Group Vpass service. Analysis of the page title, 「重要】メンテナンスのお知らせ｜VJAグループ Vpass, confirms the intent to deceive users into submitting login credentials under the guise of a maintenance notification. The domain is currently offline, but prior activity indicates a targeted campaign against Japanese-speaking users associated with VJA Group services. Infrastructure analysis reveals the domain was registered on May 17, 2025, through 商中在线科技股份有限公司 and resolved to the IPv6 address 2a06:98c1:3121::3, hosted on AS13335 (Cloudflare, Inc.). Security vendors flagged the domain as malicious, with 18 of 95 VirusTotal engines detecting it. The domain appears on two security blocklists, including PhishDestroy and PhishingDB. No SSL certificate was present, increasing the likelihood of interception or manipulation of user-submitted data. The domain has been taken offline, but residual risk remains for users who may have interacted with it prior to deactivation. Organizations are advised to monitor network logs for connections to www3-vpass.omsgx.cn or the associated IPv6 address and reset credentials for any accounts potentially exposed. Security teams should update blocklists to include this domain and its indicators, and conduct user awareness training to recognize phishing attempts leveraging brand impersonation and fake maintenance notifications.