estatex-sale[.]net

The domain estatex-sale.net was registered on June 12, 2025 through Ultahost, Inc. and resolves to the IPv4 address 198.54.132.28, which is announced by AS11878 (tzulo, inc.) in Canada. The site presents a TLS certificate issued by Let’s Encrypt for the identifier YE2, confirming that encrypted HTTPS is available but offering no indication of legitimate ownership. Reputation services record a Scamadviser trust score of 31 out of 100 and a Gridinsoft trust score of zero, suggesting a low level of perceived legitimacy.

The domain is currently listed on two public blocklists, specifically PhishDestroy and ScamSniffer, and appears on two additional security blocklists, reinforcing the view that it is being used for malicious purposes. VirusTotal analysis shows that six of ninety-five scanned security vendors flagged the domain, providing independent confirmation of suspicious activity. The page title returned by the site is "1 new message," and the campaign is classified as a "Fake Airdrop" that impersonates Microsoft, indicating that victims may be lured with promises of a token or reward tied to the Microsoft brand.

Defenders should treat estatex-sale.net as an active, elevated‑risk indicator. Immediate actions include adding the domain and its resolving IP address to outbound and inbound deny lists, updating web proxy and DNS filtering policies to block resolution, and monitoring for any internal connections to the IP or TLS handshake with the Let’s Encrypt certificate. Continuous threat‑intel feeds should be consulted for any new detections, and incident response teams should be prepared to investigate any user reports of unexpected Microsoft‑related communications that reference the "1 new message" phrasing.