hugo-dl-1-torch-questnexuser-com[.]pages[.]dev

The domain hugo-dl-1-torch-questnexuser-com.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which belongs to Cloudflare’s AS13335 network located in the United States. No SSL certificate is presented for the domain, indicating that the site was served over plain HTTP at the time of observation. The only visible page element is a title tag reading "Home," and no further content has been captured, leaving the exact phishing payload or credential‑collection mechanism unknown. VirusTotal records show that 10 of 93 scanning engines flagged the domain, providing independent confirmation of malicious intent.

Google Safe Browsing has classified the site as a social‑engineering threat, and the domain appears on the PhishDestroy blocklist, confirming placement on at least one dedicated anti‑phishing repository. The site is currently offline, which may be the result of takedown actions or the operator’s decision to retreat after detection. Infrastructure analysis indicates a simple hosting profile typical of many short‑lived phishing campaigns that leverage Cloudflare’s CDN to obscure origin and benefit from its global edge network. Defenders should immediately block the domain at network perimeter devices and add the IP address 188.114.97.3 to deny lists, recognizing that Cloudflare may host other unrelated legitimate services on the same address.

Continuous monitoring of Cloudflare‑registered subdomains for similar creation dates and lack of TLS can help surface future campaigns. Because the page content has not been archived, investigators should request a capture from external archiving services if the site reappears, to enrich attribution and enable signature generation. Until further evidence is obtained, the domain should be treated as a confirmed phishing resource with high risk to users who may be directed to it via malicious emails or social media links.