estatex[.]sale

The domain estatex.sale is currently active and resolves to the IP address 198.54.132.29, which is geolocated to Canada and announced by AS11878 tzulo, inc. Registration records show the domain was created on 12 June 2025 through Ultahost, Inc, and it uses the hostgo.tech SSL certificate. The HTTP response returns status code 200 and the page title is reported simply as "home". Infrastructure analysis reveals four authoritative name servers (ns1‑ns4.ultahost.com). The site is identified as employing the Airdrop Scam phishing kit and is classified as a Tech Support Scam that impersonates Microsoft. Reputation data indicates the domain appears on five security blocklists and is specifically blocked by PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. VirusTotal scanning shows that 2 of 95 security vendors have flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100. The composite risk rating is high. At present no additional payload or page content has been publicly disclosed beyond the title, leaving the full scope of the malicious payload uncertain. Defenders should immediately block estatex.sale at network perimeter and DNS layers, monitor for any outbound connections to 198.54.132.29, and consider sinkholing the domain to disrupt the phishing infrastructure. Continuous observation of the listed blocklists for changes and periodic rescans with updated sandbox tools are recommended to detect any evolution of the underlying kit or additional malicious behavior.