xn--sumr-dpa[.]money

Analysis of the domain xn--sumr-dpa.money, created on February 21 2026 and currently taken offline, shows multiple indicators of malicious use consistent with a generic phishing operation. The domain resolves to the IP address 104.21.16.1, which belongs to Cloudflare’s network (AS13335) and is geolocated in the United States. DNS resolution is handled by two Cloudflare‑provided name servers, felipe.ns.cloudflare.com and harleigh.ns.cloudflare.com, confirming that the infrastructure is being proxied through Cloudflare’s edge services. The site presented an HTTP status code of 403 and a page title of “Index of /”, suggesting that the underlying web server was either deliberately hidden or inaccessible at the time of observation.

SSL/TLS termination is performed by Cloudflare, using a certificate issued by SSL Corporation under the Cloudflare TLS Issuing ECC CA 3, which is typical for domains using Cloudflare’s free or paid services. Security‑vendor scans on VirusTotal recorded five detections out of ninety‑three scanners, indicating that a subset of antivirus engines have identified the domain as malicious. Independent reputation services have assigned a Gridinsoft trust score of zero out of one hundred, and the domain appears on a single public blocklist. It has also been flagged by the PhishDestroy blocklist, reinforcing the phishing classification.

The technology fingerprint includes Cloudflare and HTTP/3 support, both of which are commonly leveraged by threat actors to obscure origin and improve performance. While the offline status limits direct observation of malicious payloads or phishing pages, the combination of a low trust score, multiple vendor detections, blocklist inclusion, and the “Index of /” title provides sufficient evidence for defensive teams to treat the domain as hostile. Defenders should ensure that any outbound connections to 104.21.16.