passagevpn[.]live

The domain passagevpn.live is currently flagged as an active generic phishing site and remains under investigation as of August 07, 2026. Detection tooling from PhishDestroy has explicitly blocked the domain, and it also appears on a single external security blocklist, indicating that at least one independent feed has identified it as malicious. DNS resolution consistently returns the IPv4 address 31.76.75.91, confirming that the domain resolves to a live host that can be contacted by threat actors.

No additional telemetry such as registrar details, SSL certificate information, HTTP response codes, or page title data has been published in the available intelligence, leaving the exact content and target brand of the phishing campaign undetermined. The lack of publicly shared page metadata means that analysts cannot confirm whether the site mimics a specific service or brand, and the only concrete indicators are the blocklist entry and the resolved IP address. Defenders should prioritize adding passagevpn.live to local deny lists and ensure that any network‑level filtering solutions block traffic to 31.76.75.91.

Continuous monitoring of the IP reputation and periodic re‑query of public blocklists are advised, as the threat actor may pivot to additional infrastructure or modify the payload. Incident response teams should also consider correlating internal logs for any outbound connections to this domain or IP, and if observed, isolate affected endpoints for further forensic analysis. Because the site’s content has not been publicly captured, threat intel teams are encouraged to request a safe‑browse snapshot or perform a controlled sandbox visit to enrich the profile, but any such activity must follow organizational policies and isolation standards.