www3-vpass[.]fpbrg[.]cn

This domain, www3-vpass.fpbrg.cn, is flagged for credential theft. Analysis indicates that the site is designed to trick users into providing their login credentials, potentially leading to account compromise and data theft. The threat level is elevated, and the domain is currently offline.

Analysis indicates that 17 out of 95 security vendors on VirusTotal flag this domain as malicious. The domain was registered on May 20, 2025, through 包头市特木鲁网络科技有限公司. It resolves to the IP address 172.67.159.40, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The site's page title, 【重要】メンテナンスのお知らせ｜VJAグループ Vpass, suggests a maintenance notice for the VJA group, which is a common tactic used in brand impersonation attacks. The domain has been blocked by PhishDestroy and PhishingDB and appears on 2 security blocklists.

If a user has visited www3-vpass.fpbrg.cn, they should immediately change the passwords for any accounts they may have entered credentials into on the site. Additionally, users should monitor their accounts for any unusual activity and consider enabling two-factor authentication (2FA) for an added layer of security. Reporting the incident to the relevant service provider and performing a full system scan for any malware is also recommended.