passkeyadd[.]com

Analysis of the domain passkeyadd.com indicates it is an active phishing infrastructure targeting users with a passkey-themed scam. Registered on May 8, 2026, through Tucows Domains Inc., the domain currently resolves to the IP address 185.178.208.153. As of July 29, 2026, the domain is flagged by 17 out of 91 security vendors on VirusTotal, suggesting detection by multiple threat intelligence sources. Additionally, it appears on at least one security blocklist and is specifically blocked by PhishDestroy, reinforcing its classification as malicious.

The domain's creation date aligns with recent phishing campaigns leveraging passkey-related lures, though the exact content and targeting methodology remain unconfirmed. No specific brand impersonation or scam subtype (e.g., credential harvesting, malware distribution) has been identified in available data. The hosting IP, 185.178.208.153, has not been linked to other known malicious domains in public feeds at this time, though further infrastructure analysis may reveal additional associations. Defenders should treat passkeyadd.com as an elevated-risk domain.

Network-level blocking is recommended, particularly for organizations implementing passkey authentication systems. Security teams should monitor for connections to the domain or its associated IP address, as these may indicate compromised endpoints or targeted phishing attempts. If user reports or logs confirm interaction with this domain, immediate incident response actions—such as credential resets and endpoint scans—should be initiated. Given the domain's recent registration and active detection by security vendors, continued monitoring for updates to its detection status and infrastructure is advised.