www3-vpass[.]kbqrc[.]cn

The domain www3-vpass.kbqrc.cn has been identified as a credential theft phishing site impersonating the VJAグループ. The domain is currently offline and no longer accessible. This domain was registered through 商中在线科技股份有限公司 and resolves to the IP address 172.67.214.86, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network.

Analysis indicates that the domain was flagged by 18 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion. The domain was created on May 17, 2025, and has appeared on one security blocklist. The page title found on the domain is 【重要】メンテナンスのお知らせ｜VJAグループ Vpass, which translates to 'Important Maintenance Notice | VJA Group Vpass'. The domain does not have an SSL certificate, which is a common indicator of a phishing site. Infrastructure analysis reveals that the domain's IP address is hosted by Cloudflare, a known provider for web services, potentially used to mask the true origin of the threat.

Given the current status of the domain (offline), it is recommended that security teams continue to monitor for any reactivation or similar domains. Additionally, users and employees should be advised to remain vigilant and verify the legitimacy of any communications purportedly from VJAグループ. Security awareness training should emphasize the importance of checking URLs and avoiding entering sensitive information on unsecured sites.