btsellfy[.]sellfy[.]store

The domain btsellfy.sellfy.store was created on 21 February 2026 through Go Daddy, LLC and is currently taken offline. DNS resolution points to the IP address 3.214.66.127, which belongs to the Amazon.com, Inc. network (AS14618) and is geolocated in the United States. The authoritative name servers are kara.ns.cloudflare.com and will.ns.cloudflare.com, indicating Cloudflare DNS services. An HTTPS endpoint is served using a Let’s Encrypt certificate issued by the E7 intermediate, confirming the presence of a valid TLS layer despite the site’s offline status. Web‑server fingerprints reveal Nginx with the OpenResty module and client‑side libraries including jQuery. An HTTP request to the root path returns a 404 status code and the page title "Store Doesn't Exist," suggesting that the site no longer hosts active content.

Threat intelligence shows that the domain is listed on one security blocklist and has been blocked by the PhishDestroy feed. VirusTotal analysis recorded 11 detections out of 93 scanned security vendors, providing independent confirmation that the domain is associated with malicious activity. No further public threat feeds or Safe Browsing entries are referenced in the available data.

The observed indicators—recent registration, Amazon‑hosted IP, Cloudflare DNS, active TLS certificate, and multiple vendor detections—are consistent with a short‑lived phishing infrastructure that was likely used to host a fraudulent storefront before being shut down. The exact phishing campaign details, such as targeted brands or lure content, remain unknown because the page content is not available.

Defenders should continue to block the domain at perimeter defenses, ensure that any outbound connections to 3.214.66.127 are denied, and monitor for newly registered look‑alike domains that resolve to the same ASN or use similar naming patterns.