mmsleek[.]sellfy[.]store

Analysis of mmsleek.sellfy.store indicates that the domain was registered on February 21 2026 through Go Daddy, LLC and resolves to the IP address 3.214.66.127, which belongs to Amazon.com, Inc. (AS14618) and is geolocated in the United States. The authoritative nameservers are kara.ns.cloudflare.com and will.ns.cloudflare.com, confirming the use of Cloudflare DNS. An HTTPS service is present, secured by a Let’s Encrypt certificate (issuer E7) that matches the host name, but the web server returns HTTP 404 with the page title “Store Doesn’t Exist”. The underlying stack is identified as Nginx with OpenResty and jQuery, typical of generic hosting environments. The domain appears on a single public blocklist and has been explicitly blocked by PhishDestroy.

VirusTotal analysis shows that 9 of 93 scanners flagged the host, reinforcing the suspicion of malicious activity. The current operational status is offline, and the risk rating is elevated. The evidence confirms that the domain has been used for generic phishing, although the exact payload or credential‑harvesting page has not been captured; only the empty “Store Doesn’t Exist” page is observable. Uncertainty remains regarding the specific targets or lures employed, as no additional content has been retrieved.

Defenders should treat the domain as hostile, enforce network‑level deny rules for both the domain name and its resolved IP, and add it to internal threat‑intel feeds. Ongoing monitoring of the associated IP range and Cloudflare nameservers is advised, as the infrastructure may be reused for future campaigns. Because the SSL certificate is valid, standard TLS inspection should be applied to detect any hidden traffic if the site becomes active again. Continuous re‑scanning with multi‑engine services is recommended to capture any changes in detection scores.