sunpass[.]overduekcc[.]vip

Analysis of the domain sunpass.overduekcc.vip indicates an active phishing infrastructure targeting users of the SunPass electronic toll collection system. The domain was registered on October 7, 2025, through Namemart Limited, a registrar frequently associated with abusive registrations. As of July 29, 2026, the domain resolves to the IP address 43.153.101.139, which has been flagged in prior threat intelligence for hosting fraudulent sites.

Thirteen of ninety-one security vendors on VirusTotal have classified this domain as malicious, and it appears on at least one security blocklist, including PhishDestroy. The specific content of the site remains unconfirmed, though the domain name and path structure strongly suggest an impersonation of SunPass, likely presenting fake toll violation notices or payment prompts to harvest credentials or financial data.

Defenders are advised to block the domain and its resolving IP at the network level, monitor for related subdomains or newly registered lookalike domains, and alert users to verify any SunPass communications through official channels. The elevated risk classification is supported by the combination of recent registration, low detection but non-zero vendor flags, and known blocklist inclusion, though further forensic analysis of the site itself would be required to confirm the exact phishing kit or payload in use.