register-imf[.]quest

Analysis as of July 25 2026 indicates that the domain register-imf.quest was registered on February 21 2026 and is currently taken offline. The site presented the page title "IMF.BZ Portal" and was classified as a crypto‑scam that impersonates the Telegram brand. The infrastructure resolves to the IP address 172.67.221.51, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The SSL certificate associated with the host is identified as WE1, providing no additional trust signals.

Reputation services rate the domain poorly; Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on two security blocklists, PhishDestroy and ScamSniffer. VirusTotal analysis shows that 2 of 93 scanning engines flagged the domain, reinforcing the malicious assessment. Because the site is offline, active content cannot be inspected, and the exact phishing or malware payload remains unknown. Defenders should continue to block the domain and its resolving IP at perimeter and DNS filtering layers, incorporate the two blocklist entries into existing threat‑intel feeds, and monitor for any re‑hosting of the same certificate or page title on other domains.

Additional scrutiny of traffic to Cloudflare‑owned IP ranges that matches the observed patterns is advised, as threat actors often reuse infrastructure. Continuous review of any future VirusTotal or similar scans is recommended to capture evolving detection coverage. Organizations that use Telegram should be alert to unsolicited messages that reference "IMF.BZ" or similar phrasing, even though the current site is inactive.