www3-vpass[.]ckeym[.]cn

The domain www3-vpass.ckeym.cn is identified as a high-risk phishing site impersonating Vpass, a service under the VJA Group. Analysis confirms the domain operates under the generic_phishing threat category, designed to harvest user credentials through deceptive maintenance notifications. The page title, 『重要】メンテナンスのお知らせ｜VJAグループ Vpass, explicitly mimics legitimate Vpass communications to trick users into submitting sensitive information. As of the latest assessment, the domain has been taken offline, though prior activity remains a significant concern for organizations and individuals exposed to the campaign. Infrastructure analysis reveals the domain was registered on May 17, 2025, through 商中在线科技股份有限公司, a registrar frequently associated with malicious registrations. The domain resolves to the IP address 104.21.25.179, hosted on Cloudflare's network (AS13335), a common tactic to obscure origin servers and evade detection. VirusTotal reports 17 of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly categorizes it as phishing. The domain also appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate, issued by TrustAsia Technologies, Inc. under the LiteSSL RSA CA 2025, does not mitigate the risk, as phishing sites routinely employ valid certificates to appear legitimate. Current status indicates the domain is offline, reducing immediate exposure risk. However, the infrastructure remains a potential threat vector for future campaigns. Organizations are advised to block the domain and IP at perimeter defenses, including firewalls and DNS filters. Users who accessed the site should assume credential compromise and initiate password resets for Vpass and associated accounts. Security teams should monitor for indicators of compromise (IOCs), including the domain, IP, and SSL certificate thumbprint, in network logs and endpoint telemetry. Proactive hunting for related domains registered through the same registrar or resolving to Cloudflare IPs is recommended to identify potential follow-on threats.