sunpass[.]overduekcp[.]vip

Analysis as of July 29 2026 indicates that the domain sunpass.overduekcp.vip is actively leveraged in a generic phishing campaign. The domain was registered on October 07 2025 through Namemart Limited, a registrar that has been associated with other malicious registrations. DNS resolution points to the IPv4 address 43.153.101.139; this host is currently listed on a single security blocklist and is blocked by the PhishDestroy sinkhole, confirming its malicious intent. VirusTotal reports that 13 of 91 scanned security vendors flag the domain as malicious, providing independent corroboration of the threat.

The domain’s risk level is classified as elevated and its status remains active, suggesting ongoing exploitation. No additional public intelligence such as Safe Browsing alerts, OTX tags, or SSL certificate details are presently available, leaving the broader infrastructure and potential payloads uncharacterized. Defenders should prioritize blocking outbound connections to 43.153.101.139 and add sunpass.overduekcp.vip to internal deny lists.

Monitoring for DNS queries to this domain and correlating any user‑initiated HTTP requests with the known blocklist entry will aid in early detection. Because the site’s content has not been publicly dissected, analysts should consider sandboxing any retrieved pages to capture possible credential‑stealing forms or secondary redirects. Continuous re‑evaluation is advised as further indicators, such as additional vendor detections or expanded blocklist listings, may emerge.