sunpass[.]overduekcu[.]vip

Analysis of sunpass.overduekcu.vip indicates an active generic phishing infrastructure. The domain was registered on 2025-10-07 through Namemart Limited and currently resolves to the IPv4 address 43.153.101.139. Defensive feeds have listed the domain on a single blocklist, specifically PhishDestroy, confirming that at least one security community has taken mitigation action. VirusTotal scans show that 12 of 91 AV engines flagged the domain, providing independent vendor corroboration of malicious intent.

No public Safe Browsing, OTX, SSL certificate, HTTP response code, trust‑score, or page‑title information is presently available, limiting visibility into the site’s content or transport security posture. The lack of additional blocklist listings or broader vendor consensus suggests the domain may be in an early deployment stage or employing evasion techniques to avoid widespread detection. Defenders should add the domain and its resolving IP address to local deny lists, monitor DNS queries for the name and the 43.153.101.139 host, and enforce outbound filtering for HTTP/HTTPS traffic to the address.

Continuous re‑scanning with multi‑engine services is advised to capture any evolution in the payload or hosting changes. Incident response teams should treat any credential submissions to the domain as compromised and initiate credential reset procedures for affected accounts. Ongoing intelligence collection, including periodic checks of Safe Browsing and OTX feeds, will help determine whether the campaign expands its footprint or adopts new infrastructure.