btinternetttt[.]sellfy[.]store

The domain btinternetttt.sellfy.store has been confirmed as a site used for credential theft, a specific type of phishing attack, and is currently offline. The domain was registered through Go Daddy, LLC and first created on February 21, 2026. It appears to be part of a malicious infrastructure designed to deceive users into providing sensitive credentials, often impersonating trusted entities though no specific brand impersonation was noted in the investigation.

The domain has been flagged by 16 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion and risk associated with it. Hosted under the IP address 3.214.66.127, which is located in the United States under the AS14618 Amazon.com, Inc., this domain was also blocked by notable blocklisting services such as PhishDestroy and PhishingDB. The presence on two security blocklists further corroborates its involvement in malicious activities. A Let's Encrypt SSL certificate was found associated with this domain, which could be an attempt to lend legitimacy to the site. Despite this, the domain's title shows as 'Store Doesn't Exist', which is consistent with its offline status and may indicate a takedown or obfuscation attempt by the operators.

Currently, the domain is offline, reducing the immediate threat it poses. However, it's recommended that organizations and individuals remain vigilant against domains with similar patterns or setup characteristics. Continuous monitoring of threat intelligence feeds and maintaining updated blocklists can mitigate exposure to future threats. It's crucial to educate users on identifying phishing attempts and ensure robust security mechanisms, like multi-factor authentication, are in place to reduce the impact of credential theft on user accounts.