sunpass[.]overduekcy[.]vip

Analysis indicates that the domain sunpass.overduekcy.vip was registered through Namemart Limited and first observed on 7 October 2025. DNS resolution points exclusively to the IPv4 address 43.153.101.139, which is currently listed on a single public security blocklist and has been actively blocked by the PhishDestroy feed. On VirusTotal the domain is flagged by 13 of 91 uploaded scanners, confirming that multiple independent engines have identified malicious characteristics.

The elevated risk rating aligns with the observed detection count and the active blocking status. No additional intelligence such as SSL certificate details, HTTP response codes, page title, or content snapshots has been released, leaving the exact phishing lure and targeted brand undefined. The limited public exposure—in particular the single blocklist appearance—suggests the infrastructure may be in early deployment or operating with a low‑profile hosting arrangement.

Defenders should add the IP 43.153.101.139 to outbound allow‑list exclusions, enforce DNS sink‑hole or block rules for the full FQDN, and monitor any future detections from additional scanning services. Continuous re‑query of reputation services and periodic WHOIS checks are recommended to capture potential changes in registrar information or hosting relocation. Organizations employing email gateway or web proxy filtering should ensure that traffic to this domain is denied, and incident response teams should treat any credential submissions to the URL as potentially compromised.