www3-vpass[.]godqo[.]cn

This domain, www3-vpass.godqo.cn, poses a high-risk phishing threat designed to mimic legitimate VPN authentication portals. Analysis indicates the site likely targets corporate or personal VPN users by presenting a fraudulent login interface to capture credentials, session tokens, or multi-factor authentication codes. The use of a subdomain (www3-vpass) suggests an attempt to impersonate a secure access gateway, a common tactic in credential harvesting campaigns targeting remote workers or enterprise networks. Infrastructure analysis reveals concrete indicators of malicious intent. The domain was registered on May 17, 2025, through 商中在线科技股份有限公司, a registrar frequently associated with short-lived phishing domains. It resolves to IP address 172.67.216.65, hosted on Cloudflare’s network (AS13335), which provides anonymity and complicates takedown efforts. Security vendors have flagged the domain 20 times out of 95 on VirusTotal, with Google Safe Browsing and two additional blocklists confirming its phishing classification. The SSL certificate, issued by TrustAsia Technologies, Inc., further masks its malicious nature by presenting a seemingly legitimate encrypted connection. Users who visited www3-vpass.godqo.cn should take immediate action to mitigate potential compromise. First, reset any credentials entered on the site, prioritizing passwords for VPNs, email accounts, or other sensitive services. Enable multi-factor authentication if not already active, and monitor accounts for unauthorized access or unusual activity. If corporate credentials were exposed, report the incident to internal security teams to initiate incident response protocols. Additionally, check local devices for malware or unauthorized software installations, as phishing sites often deploy secondary payloads. Block the domain and its associated IP (172.67.216.65) at the network level to prevent future access. Given the domain’s current offline status, users should remain vigilant for similar threats, particularly those mimicking VPN or remote access portals.