amlsumsubfixin[.]top

The domain amlsumsubfixin.top was registered through NameSilo, LLC on 21 February 2026 and is currently listed as offline. DNS resolution points to the IPv4 address 161.35.151.230, which belongs to AS14061 DigitalOcean, LLC and is geolocated in the Netherlands. The domain uses the authoritative name servers ns1.dnsowl.com, ns2.dnsowl.com and ns3.dnsowl.com. No TLS certificate is presented, meaning the site served only over plain HTTP.

On VirusTotal the domain received detections from 2 of 93 security vendors, indicating that at least two scanners flagged it as malicious. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on one external security blocklist, where it is also flagged by PhishDestroy. The only observed page title is “Sumsub – Identity Verification”, while the intelligence tags the site as a crypto‑scam that impersonates the brand Tron. The combination of a brand‑targeted title, a low‑trust score, and multiple vendor detections suggests a deliberate attempt to lure victims into a Tron‑related cryptocurrency fraud, likely by exploiting the reputation of the Sumsub verification service.

Because the site is presently offline, immediate disruption is limited, but the underlying infrastructure – the DigitalOcean IP, the dnsowl name servers, and the registration details – remains reusable. Defenders should block the domain and its hosting IP, add the observed name servers to watch lists, and monitor for new registrations that reuse the same registrar or similar naming patterns. Ongoing threat‑intel feeds should be consulted for any re‑appearance of the domain or related indicators, and any inbound traffic to the IP should be inspected for malicious payloads.