www3-vpass[.]asiqb[.]cn

This domain, www3-vpass.asiqb.cn, poses a high-risk phishing threat by impersonating the VJA Group Vpass service, a Japanese credit card authentication platform. The fraudulent page displays a maintenance notice in Japanese, titled 「重要】メンテナンスのお知らせ｜VJAグループ Vpass, designed to deceive users into submitting sensitive credentials or financial information under the pretext of system updates. The use of a Japanese-language interface and branding consistent with legitimate VJA Group communications increases the likelihood of successful social engineering, particularly among users expecting official notifications from the service. Analysis of the domain infrastructure reveals multiple technical indicators of malicious intent. The domain was registered on May 24, 2025, through 长沙小豆网络科技有限公司, a registrar frequently associated with newly created phishing domains. It resolves to the IP address 104.21.83.214, hosted on AS13335 (Cloudflare, Inc.), a network commonly leveraged to obfuscate malicious infrastructure. The SSL certificate, issued by TrustAsia Technologies, Inc. under the LiteSSL RSA CA 2025 hierarchy, provides a false sense of security while failing to mitigate the underlying threat. Detection metrics further confirm its malicious nature, with 17 out of 95 security vendors on VirusTotal flagging the domain as phishing, and its presence on one additional security blocklist. Google Safe Browsing has also classified this domain as phishing, reinforcing its fraudulent purpose. Users who accessed or interacted with www3-vpass.asiqb.cn should take immediate remedial action to mitigate potential compromise. All credentials entered on the site must be considered exposed and should be changed immediately from a secure, unrelated device. Financial institutions associated with VJA Group Vpass accounts should be notified to monitor for unauthorized transactions. System scans using updated security tools are recommended to detect any secondary payloads or malware introduced during the interaction. Users are advised to verify the authenticity of any future communications by accessing official services directly through verified URLs, rather than following links from unsolicited messages. Awareness of domain spoofing techniques, such as the use of subdomains or slight misspellings, is critical to preventing future incidents.