vpass-jp[.]bpcot[.]cn

This domain, vpass-jp.bpcot.cn, operates as a fake online casino phishing site impersonating the K8 brand, as indicated by the page title 'K8凯发娱乐.' The site targets users by presenting fraudulent gambling interfaces designed to harvest login credentials, financial details, or deposit funds into attacker-controlled accounts. Analysis of the page structure and content suggests a focus on Chinese-speaking users, with the intent to deceive victims into believing they are interacting with a legitimate gambling platform. The presence of payment prompts and account registration forms further supports the credential theft and financial fraud objectives of this campaign.

Technical indicators confirm the malicious nature of this domain. VirusTotal reports 17 out of 95 security vendors flagging vpass-jp.bpcot.cn as malicious, while Google Safe Browsing explicitly classifies it as a phishing site. The domain was registered on May 17, 2025, through 商中在线科技股份有限公司, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.136.191, hosted on Cloudflare's infrastructure (AS13335), which is commonly leveraged to obfuscate the true origin of malicious traffic. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB, and its SSL certificate, issued by TrustAsia Technologies, Inc. under LiteSSL RSA CA 2025, does not mitigate the underlying threat.

Users who visited vpass-jp.bpcot.cn should take immediate action to mitigate potential compromise. If credentials or financial information were entered, affected accounts must be secured by changing passwords and enabling multi-factor authentication where available. Financial institutions should be notified if payment details were submitted, and transactions should be reviewed for unauthorized activity. Browser data, including cookies and cached files, should be cleared to remove any residual tracking or session persistence. Monitoring for phishing attempts via email or messaging platforms is recommended, as attackers may attempt follow-up exploitation using harvested contact details.