vpass-jp[.]rbegd[.]cn

Domain vpass-jp.rbegd.cn is assessed as a generic_phishing endpoint impersonating VJA Group Vpass authentication services. The infrastructure and page title indicate a credential harvesting attempt mimicking maintenance notification content. The domain is currently offline, reducing active exposure but not eliminating residual risk due to prior distribution.

Telemetry and external intelligence show the domain was flagged by 18 of 95 VirusTotal security vendors. Registration records indicate it was registered through 商中在线科技股份有限公司. Network resolution points to IP 172.67.204.113, hosted within AS13335 Cloudflare, Inc., with geolocation attributed to the United States. Domain creation date is recorded as May 17, 2025. Additional indicators include absence of a valid SSL certificate and presence on 2 known security blocklists, specifically PhishDestroy and PhishingDB. The same IP endpoint resolves directly to the observed host, suggesting centralized hosting infrastructure.

At present, the domain status is taken offline, which indicates mitigation actions by hosting providers or blocklisting entities. However, historical evidence suggests it was actively used for credential phishing, likely targeting VJA Vpass users. Security teams should maintain blocklist enforcement, monitor for re-registration under similar naming patterns, and implement DNS/IP-based filtering for 172.67.204.113 if correlated malicious activity persists. Users should be warned not to enter credentials on any pages referencing Vpass maintenance notices unless verified through official channels. Continued monitoring of certificate issuance attempts and domain resurrection under rbegd.cn subdomains is recommended.