om4qafig[.]sellfy[.]store

Analysis of om4qafig.sellfy.store indicates that the domain was registered on February 21 2026 through Go Daddy, LLC and points to the Amazon‑owned IP address 3.214.66.127 (AS14618). The hosting environment serves content via Nginx with OpenResty and includes jQuery, and the site presents a Let’s Encrypt certificate issued under the E7 profile. An HTTP request returns a 404 response and the page title is “Store Doesn’t Exist,” which aligns with the current offline status.

VirusTotal records show that nine of ninety‑three scanning engines have flagged the domain, and the domain is listed on a single external blocklist that has been consumed by PhishDestroy, which is actively blocking it. The domain’s DNS resolves through Cloudflare name servers kara.ns.cloudflare.com and will.ns.cloudflare.com, indicating use of Cloudflare’s DNS proxy. While the evidence confirms that the domain is associated with a generic phishing campaign and has been identified by multiple security vendors, the limited number of blocklist entries and the recent creation date mean that broader detection coverage may still be evolving.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑appearance of the site on additional reputation feeds, and consider adding the IP address 3.214.66.127 to any host‑based deny lists. Ongoing verification of the SSL certificate and periodic re‑scans with multi‑engine services are recommended to capture any future changes in malicious behavior.