estfor[.]deif[.]eth[.]limo

Analysis of the domain estfor.deif.eth.limo shows a newly registered address (creation date February 21 2026) hosted on Amazon’s IPv6 range (2600:1f16:502:7c03:f998:2c76:b211:4c4e, AS16509, United States). The zone uses four AWS name servers (ns-814.awsdns-37.net, ns-1689.awsdns-19.co.uk, ns-48.awsdns-06.com, ns-1…) and serves content over HTTPS with a valid Let’s Encrypt certificate (E8). The site returns HTTP 301 and reports technologies including IPFS, Vue.js, HSTS, and HTTP/3. The page title “Deif’s Estfor Plaza” is the only visible content. Threat intelligence classifies the site as a high‑risk crypto scam; one of ninety‑five VirusTotal scanners flagged the domain, Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a security blocklist. It is currently blocked by PhishDestroy. While the exact phishing payload has not been observed, the combination of a recent registration, Amazon‑hosted infrastructure, low trust scores, and a known crypto‑scam classification indicates a credible malicious operation. Defenders should block the domain and associated IPv6 address at perimeter controls, monitor DNS queries for the domain and its name servers, and consider sinkholing the IP range if feasible. Ongoing surveillance is advised to detect any evolution of the site’s content or additional infrastructure components.