sunpass[.]overduekcx[.]vip

sunpass.overduekcx.vip is an active generic phishing infrastructure observed on July 29 2026. The domain was registered on October 07 2025 through Namemart Limited and currently resolves to the IPv4 address 43.153.101.139. Intelligence indicates that the domain appears on one public security blocklist and is explicitly blocked by the PhishDestroy service. VirusTotal analysis shows that 12 of 91 scanning engines have flagged the domain as malicious, reinforcing the elevated risk rating assigned by analysts.

The registration date, resolver IP, and blocklist presence suggest a deliberately provisioned phishing campaign rather than a compromised legitimate site. However, public scans have not disclosed additional artifacts such as SSL certificate details, HTTP response codes, page titles, or content signatures, so the exact phishing lure and target brand remain unknown. The lack of publicly available page metadata limits attribution of the specific social-engineering vector employed. Defenders should treat sunpass.overduekcx.vip as hostile.

Immediate mitigation steps include adding the domain and its resolving IP to network deny lists, updating endpoint and web-gateway filters, and ensuring that any existing URL-filtering solutions ingest the PhishDestroy blocklist entry. Continuous monitoring of the IP address for anomalous traffic patterns is advised, as the host may serve additional malicious payloads or act as a redirector for other phishing domains. Analysts should also request full HTTP capture and TLS handshake data to enrich future investigations and confirm the phishing payload delivered to victims.