sunpass[.]overduekcr[.]vip

Analysis as of July 29 2026 indicates that the domain sunpass.overduekcr.vip is actively used in a generic phishing campaign. The domain was registered on October 07 2025 through Namemart Limited and resolves to the IPv4 address 43.153.101.139. VirusTotal reports that 14 of 91 security vendors have flagged the domain, indicating a moderate level of detection across multiple scanners. The domain appears on one security blocklist and is listed as blocked by the PhishDestroy service, confirming that at least one external mitigation platform has taken action against it.

No additional public intelligence such as page title, SSL certificate details, or HTTP response codes has been disclosed, so the exact content hosted at the domain remains unverified. The presence of multiple vendor detections combined with blocklist inclusion suggests that the infrastructure is being leveraged to lure victims to submit credentials or other sensitive information. Defenders should update their ingress and egress filtering to deny traffic to 43.153.101.139 and to the fully qualified domain name sunpass.overduekcr.vip. Adding the domain to internal blocklists, DNS sinkholing, or employing URL filtering solutions that reference the PhishDestroy blocklist will reduce exposure.

Continuous monitoring of the IP address for any changes in hosting or additional malicious activity is advised, as threat actors frequently repurpose compromised servers. Organizations that have observed related phishing attempts should correlate timestamps with the domain creation date to assess potential exposure windows. Until further forensic analysis of the hosted content is available, the domain should be treated as malicious and blocked across all relevant security controls.