gfhtyyriiifabulous[.]sellfy[.]store

Analysis of gfhtyyriiifabulous.sellfy.store shows a newly registered domain created on 21 February 2026 that is currently taken offline, returning a 404 HTTP status with the page title “Store Doesn't Exist.” The site was hosted on Amazon's AS14618 network, resolving to the IP address 3.214.66.127 located in the United States. Infrastructure fingerprints reveal an Nginx/OpenResty web server stack with jQuery present, and the TLS certificate was issued by Let’s Encrypt (E7), indicating a legitimate‑looking HTTPS endpoint. Domain registration was performed through Go Daddy, LLC, and DNS is delegated to Cloudflare nameservers (kara.ns.cloudflare.com and will.ns.cloudflare.com).

The domain appears on a single security blocklist, specifically PhishDestroy, confirming that at least one phishing‑focused feed has flagged the host. VirusTotal scans show that 11 of 93 antivirus and URL‑reputation engines flagged the domain, providing additional corroboration of malicious intent. No public evidence of the actual phishing page content is available beyond the generic “Store Doesn't Exist” title, and the site’s current offline state prevents further payload observation.

Defenders should add the domain to internal block lists, monitor the associated IP range for other potentially related activity, and enforce DNS filtering for the Cloudflare name servers that resolve this host. Continuous re‑evaluation is advised in case the domain is reactivated, as the existing evidence—registration date, blocklist inclusion, VirusTotal detections, and infrastructure characteristics—strongly suggests it was used for a phishing store operation.