sunpass[.]overduekct[.]vip

Analysis of sunpass.overduekct.vip indicates that the domain is actively being used for phishing operations and should be treated as a high‑confidence threat. The domain was registered on October 07, 2025 through Namemart Limited and resolves to the IPv4 address 43.153.101.139. VirusTotal reports that 14 of 91 security vendors have flagged the domain, demonstrating a measurable detection rate across multiple scanners.

The site is listed on a public security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, reinforcing the consensus that the domain is malicious. The risk rating assigned by the reporting platform is elevated, and the operational status is marked as active, suggesting ongoing malicious activity. No public information is currently available regarding the site’s SSL certificate, HTTP response codes, or page title, and the content of the landing page has not been disclosed in the intelligence feed.

Consequently, defenders lack visibility into the specific credential‑stealing payload or any potential redirection mechanisms. Given the confirmed detections, the presence on blocklists, and the active status, security teams should add sunpass.overduekct.vip and its resolving IP address 43.153.101.139 to deny lists, enforce DNS sink‑holing where possible, and monitor network traffic for any connections to the domain. Continuous re‑evaluation is recommended in case additional indicators, such as payload hashes or phishing kit signatures, become available.