btservicemailbox[.]sellfy[.]store

Analysis of btservicemailbox.sellfy.store shows that the domain was registered on 21 February 2026 through GoDaddy, LLC and is hosted on an Amazon.com, Inc. infrastructure (AS14618) in the United States, resolving to 3.214.66.127. The server presents an Nginx/OpenResty stack with jQuery detected, and a publicly trusted Let’s Encrypt certificate issued by the E7 intermediate. An HTTP request returns a 404 status and the page title “Store Doesn’t Exist”, indicating that the site is currently offline or deliberately returning a not‑found page. Despite the inactive content, the domain has been flagged by 11 of 93 VirusTotal scanners as malicious and is listed on a single security blocklist.

PhishDestroy has also blocked the domain. The domain’s nameservers are kara.ns.cloudflare.com and will.ns.cloudflare.com, which are typical of Cloudflare‑managed DNS. The combination of a recent registration, use of a reputable CDN, and a valid TLS certificate is consistent with infrastructure commonly employed for phishing campaigns.

At present, no additional artifacts such as phishing landing pages, credential‑harvesting forms, or targeted brand references have been observed, so the exact payload or victim‑targeting strategy remains unknown. Defenders should continue to monitor the domain for any change in HTTP response, add the IP address 3.214.66.127 to network‑level blocklists, and ensure that URL filtering solutions incorporate the current blocklist entry. Further investigation of traffic to the IP and correlation with other Amazon‑hosted phishing domains may reveal additional campaign components.