passportcloud[.]net

passportcloud.net is identified as a generic_phishing infrastructure presenting itself as a passport PSD template marketplace, advertising editable passport design assets while functioning as deceptive content delivery. The threat model suggests user engagement via counterfeit digital product offerings to harvest sensitive information or redirect to malicious flows.

Technical telemetry shows VirusTotal detection rate of 5/95 security vendors flagging the domain. The infrastructure resolves to IP 104.21.7.110 and uses SSL issued by Google Trust Services. Domain registration is handled through CSL Computer Service Langenbach GmbH d/b/a joker.com, with creation date June 03, 2026. The domain appears on 1 security blocklist and has been identified by PhishDestroy. Additional observed stack components include Bootstrap, GSAP, Yandex.Metrika, jQuery, JivoChat, Google Hosted Libraries, Google Analytics, and Font Awesome, indicating a content-heavy frontend commonly associated with templated phishing storefronts.

At present, the domain is reported as taken offline, indicating partial disruption of active hosting. However, historical indicators and prior resolution data suggest residual risk due to potential reactivation or clone deployment under similar infrastructure patterns. Continued exposure risk exists through mirrored domains or rehosting on adjacent IP ranges. Recommended response actions include sustained monitoring of related infrastructure, enrichment of blocklists across detection platforms, and tracking of SSL certificate reuse patterns or registrar abuse signals. Despite current offline status, prior multi-source detection and phishing classification indicate non-negligible risk persistence in the ecosystem, warranting ongoing defensive surveillance and periodic revalidation of domain activity status.