clickpassbus[.]com

PhishDestroy identifies clickpassbus.com as an active pass-the-cookie phishing domain targeting credential harvesting and session hijacking. The domain mimics legitimate authentication gateways to trick users into surrendering browser cookies and session tokens. No known brand or drainer kit is directly associated with this infrastructure at this time, indicating a likely opportunistic campaign rather than a highly customized attack chain.

This domain was flagged by 17 of 95 VirusTotal security vendors and is currently blocked by InversionDNS. It resolves to IP address 34.111.179.208 and is registered through Fewmoretaps OU d/b/a Trustname.com. The domain was created on April 13, 2026, and is flagged by Google Safe Browsing under the SOCIAL_ENGINEERING category. It also appears on 1 security blocklist and uses a Let's Encrypt SSL certificate—all indicators common to fast-flux or low-cost phishing operations.

clickpassbus.com remains active with a high-risk classification and has not been fully mitigated by all security layers. Users should avoid visiting the domain and organizations should block both the domain and IP address at the network perimeter. The combination of recent registration, low VT detection ratio, and active SOCIAL_ENGINEERING flag underscores the need for heightened monitoring and immediate defensive action to prevent credential theft and lateral movement.