www3-vpass[.]efqnm[.]cn

This domain, www3-vpass.efqnm.cn, operates as a credential theft infrastructure targeting users of the VJA Group Vpass payment portal. Analysis of the page title, 『重要】メンテナンスのお知らせ｜VJAグループ Vpass, reveals an attempt to impersonate official VJA maintenance notifications, a common tactic to harvest login credentials from unsuspecting victims. The domain specifically mimics urgent system updates, leveraging social engineering to prompt users into entering sensitive authentication details on fraudulent forms. Such credential theft campaigns often lead to unauthorized account access, financial fraud, or further exploitation through compromised accounts. Evidence supporting the malicious classification includes detection by 19 out of 95 security vendors on VirusTotal, indicating broad recognition of the threat. The domain was registered on May 17, 2025, through 商中在线科技股份有限公司, a registrar frequently associated with short-lived phishing domains. Infrastructure analysis reveals the domain resolves to IP address 172.67.128.131, hosted on Cloudflare's network (AS13335), which is commonly used to obfuscate the true origin of malicious sites. Additionally, the domain appears on one security blocklist and lacks SSL certification, further reducing its legitimacy. The absence of encryption increases the risk of intercepted credentials during transmission. Users who visited www3-vpass.efqnm.cn or entered credentials on the site should immediately change passwords for VJA Group Vpass and any other accounts sharing the same credentials. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor financial statements and account activity for signs of fraudulent transactions. If personal or payment information was submitted, consider placing a fraud alert with credit bureaus. Organizations should update security filters to block the domain and IP address 172.67.128.131, and educate users on recognizing social engineering tactics, particularly those exploiting maintenance or security alert themes.