1huj8[.]say-yt-host[.]workers[.]dev

Analysis of the domain 1huj8.say-yt-host.workers.dev indicates that it is associated with a generic phishing campaign and is currently offline. The domain resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution is handled by the Cloudflare nameservers clyde.ns.cloudflare.com and sofia.ns.cloudflare.com, confirming that the domain was registered through Cloudflare, Inc. on February 27, 2026. The site presents an HTTP 404 response with the page title "Page not found," and the TLS certificate is issued by Let’s Encrypt (certificate profile E7).

Detected technologies include HTTP Strict Transport Security (HSTS), Cloudflare's edge services, and support for HTTP/3, indicating the use of modern web delivery mechanisms. The domain has been blocked by the PhishDestroy service and appears on a single external security blocklist. VirusTotal reports that the domain was scanned by 93 vendors, none of which raised a detection at the time of analysis; this lack of detections does not constitute evidence of safety. The presence of a valid SSL certificate and modern protocols suggests an attempt to appear legitimate, while the 404 status and generic page title imply that the phishing payload may have been removed or never deployed.

Uncertainty remains regarding the specific victim brand or credential collection method, as no branding or login interface has been observed. Defenders should continue to block the domain at network perimeter devices, monitor DNS queries for the domain and its associated IP, and include the address in threat‑intel feeds. Ongoing observation is recommended to detect any reactivation or new content, and any future sightings should be correlated with the existing blocklist entry and SSL fingerprint for rapid identification.