www3-vpass[.]jyigz[.]cn

This domain, www3-vpass.jyigz.cn, is identified as a credential phishing site targeting users of the VJA Group Vpass service. The site displays a fraudulent Japanese-language maintenance notice designed to harvest login credentials, payment details, or personal information from unsuspecting victims. Analysis of the page title, 「【重要】メンテナンスのお知らせ｜VJAグループ Vpass」, indicates a deliberate attempt to mimic official communications from VJA Group, a legitimate financial services entity, to exploit user trust during system maintenance announcements. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered on May 17, 2025, through 商中在线科技股份有限公司, and currently resolves to the IP address 104.21.62.218, hosted on Cloudflare’s network (AS13335). No SSL certificate is present, increasing the risk of data interception during transmission. The domain is flagged by 18 out of 95 security engines on VirusTotal and appears on two independent security blocklists. Additionally, the domain has been classified as offline following detection, though residual risk remains for users who may have interacted with it prior to takedown. Users who visited www3-vpass.jyigz.cn or entered credentials on the site should take immediate action to mitigate potential compromise. All submitted credentials should be considered exposed and must be changed across all platforms where identical or similar passwords were used. Affected individuals are advised to monitor financial accounts for unauthorized transactions and enable multi-factor authentication where available. System scans for malware are recommended, as phishing sites may distribute secondary payloads. Organizations should review logs for connections to 104.21.62.218 and the domain itself to assess internal exposure. Given the elevated risk level, users should remain vigilant for follow-up phishing attempts via email or SMS referencing VJA Group or related services.