www3-vpass[.]legrd[.]cn

This domain is flagged as a confirmed brand impersonation phishing site targeting users of the VJA Group Vpass service. Analysis indicates the page displays a fraudulent maintenance notice in Japanese, designed to harvest credentials or financial information under the guise of a legitimate service update. The threat type is classified as elevated due to the targeted impersonation of a recognized financial services brand, increasing the likelihood of successful deception among users familiar with the authentic Vpass platform.

Infrastructure analysis reveals the domain www3-vpass.legrd.cn was registered on May 17, 2025, through the registrar 商中在线科技股份有限公司, a provider frequently associated with high-risk domains. The site resolves to the IP address 172.67.211.2, hosted on AS13335 (Cloudflare, Inc.), a common obfuscation tactic to conceal the true origin of malicious infrastructure. As of the latest scan, 17 out of 95 security vendors on VirusTotal detect the domain as malicious, while it appears on two independent security blocklists: PhishDestroy and PhishingDB. The domain lacks an SSL certificate, further reducing its legitimacy and increasing the risk of interception or manipulation of user-submitted data. Creation date, registrar reputation, and detection metrics collectively indicate a deliberate, short-lived campaign designed to evade detection and maximize impact before takedown.

Mitigation for users who may have interacted with this domain includes immediate credential rotation for any accounts accessed via the fraudulent site, particularly those associated with VJA Group or financial services. Organizations should add the domain and its resolving IP (172.67.211.2) to internal blocklists and monitor network traffic for connections to the identified infrastructure. Security teams are advised to analyze logs for any instances of user redirection to www3-vpass.legrd.cn, as this may indicate prior exposure to the phishing campaign. Given the domain’s recent registration and rapid inclusion on blocklists, additional related domains may emerge; proactive monitoring of newly registered domains with similar naming patterns (e.g., vpass, vja-group) is recommended to preempt further impersonation attempts.