registers-imf[.]quest

Analysis of the domain registers-imf.quest indicates that it is currently offline but retains a footprint across multiple threat‑intelligence sources. The domain was registered on February 21, 2026 and resolves to the IP address 172.67.140.82, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The TLS certificate presented by the host is identified as WE1, a standard certificate issued by a publicly trusted authority. VirusTotal scans have recorded six detections out of ninety‑three participating security vendors, confirming that at least a subset of the scanning community flags the domain as malicious.

The domain appears on two dedicated phishing blocklists—PhishDestroy and ScamSniffer—demonstrating that it has been actively shared with anti‑phishing aggregators. An AlienVault OTX pulse references the domain in a single intelligence feed, further corroborating its association with malicious activity. No public page title or content analysis is available because the site is taken offline, and no additional evidence links (such as sandbox reports or URL screenshots) have been published.

The combined indicators suggest that registers-imf.quest was employed in a generic phishing operation, likely targeting credential harvest or account takeover attempts. Defenders should continue to block the domain at network perimeter devices, update DNS filtering policies to include the listed blocklists, and monitor for any resurgence of activity from the associated Cloudflare IP range. Given the limited public artifact set, ongoing telemetry collection is recommended to capture any future re‑hosting attempts or changes in the domain’s hosting configuration.