www3-vpass[.]hsqqm[.]cn

The domain www3-vpass.hsqqm.cn has been identified as a credential theft operation targeting users through deceptive login portals. Analysis indicates the domain is currently offline but was actively distributing phishing content designed to capture sensitive authentication details, including usernames, passwords, and potentially multi-factor authentication codes. No specific brand impersonation has been confirmed, though the infrastructure aligns with credential harvesting campaigns observed in recent months. Infrastructure analysis reveals the domain was registered on May 4, 2025, through 商中在线科技股份有限公司, a registrar frequently associated with short-lived malicious domains. The domain resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.), a network commonly leveraged to obfuscate attacker infrastructure. Detection metrics indicate the domain was flagged by 17 of 95 security vendors on VirusTotal, with one additional blocklist entry confirming its malicious classification. The absence of an SSL certificate further reduces the domain's legitimacy, as modern phishing campaigns typically employ encryption to evade detection. As of the latest assessment, www3-vpass.hsqqm.cn has been taken offline, though residual risks remain for users who may have interacted with the domain prior to its deactivation. Organizations and individuals are advised to block the domain and its associated IP at the network level, monitor for unauthorized access attempts linked to credentials potentially exposed via this campaign, and verify the legitimacy of any unexpected login prompts. Security teams should review logs for connections to 188.114.97.3 and correlate with known phishing indicators to identify compromised accounts.