sumsubdefend[.]live

This domain, sumsubdefend.live, is actively impersonating a legitimate Web3 identity verification service to harvest sensitive user credentials and authentication tokens. Analysis indicates the site employs deceptive branding, including the page title 'SumsubVerified Solutions for Secure Web3 Identity Verification,' to lure victims into submitting personal identification documents, wallet addresses, and multi-factor authentication codes. The threat specifically targets users in decentralized finance (DeFi) and blockchain ecosystems, where identity verification is a common prerequisite for platform access, increasing the likelihood of successful credential compromise. Infrastructure analysis reveals the domain was registered on May 13, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk registrations. The domain resolves to IP address 87.120.219.250 and uses a Let's Encrypt SSL certificate, providing a false sense of security. As of the latest scan, VirusTotal reports 0 detections out of 95 security engines, indicating the domain has evaded widespread detection despite its active malicious status. No blocklist entries were identified at the time of analysis, further suggesting the campaign remains in an early or stealth phase. Users who have visited sumsubdefend.live or interacted with its content should immediately revoke any active sessions linked to Web3 wallets or identity verification services. All submitted credentials, including private keys, recovery phrases, and government-issued identification documents, must be considered compromised. Affected individuals should monitor associated accounts for unauthorized transactions and report the incident to relevant financial or blockchain platforms. Security teams are advised to block the domain and its resolving IP at the network perimeter and update detection rules to include the domain's SSL certificate thumbprint and page title patterns for proactive defense.