sunpass[.]overduekcw[.]vip

The domain sunpass.overduekcw.vip was created on 07 Oct 2025 and registered through Namemart Limited. It resolves to the IPv4 address 43.153.101.139, which is currently the sole host observed for this indicator. Classification from the intelligence feed labels the indicator as a generic phishing campaign with an elevated risk rating and an active status as of the report date (29 Jul 2026). VirusTotal scans have returned 14 positive detections out of 91 submitted scanners, confirming that multiple independent security engines have identified malicious behavior associated with the domain.

The domain is listed on one external security blocklist and has been explicitly blocked by the PhishDestroy filtering service, demonstrating that at least one commercial sink‑hole is already enforcing mitigation. No public TLS certificate, HTTP status code, or page‑title information is available in the current data set, so the surface‑level web content cannot be described. The absence of such metadata limits the ability to assess whether the site employs HTTPS, redirects, or specific phishing page structures. Nevertheless, the convergence of a recent registration, a dedicated IP address, multiple vendor detections, and blocklist presence strongly suggests an operational phishing infrastructure that is actively serving malicious payloads or credential‑harvesting pages.

Defensive recommendations include adding sunpass.overduekcw.vip and its resolving IP 43.153.101.139 to local DNS blocklists, intrusion‑prevention system signatures, and proxy filtering rules. Continuous monitoring of DNS query logs for repeated lookups, as well as periodic re‑scans on VirusTotal and other multi‑engine sandbox platforms, will help detect any evolution of the payload. Organizations that receive email or messaging campaigns referencing “sunpass” should treat any hyperlink to this domain as hostile and advise users to avoid interaction.