saytest1[.]say-yt-host[.]workers[.]dev

This domain, saytest1.say-yt-host.workers.dev, is under investigation for generic phishing. It was created on February 27, 2026, and registered through Cloudflare, Inc. Infrastructure analysis shows it resolves to IP 172.67.131.62, hosted in the United States on AS13335 (Cloudflare), with nameservers clyde.ns.cloudflare.com and sofia.ns.cloudflare.com. Technologies detected include HSTS and HTTP/3. The SSL certificate was issued by Let's Encrypt (E7).

When accessed, the page returned an HTTP 404 status with the title 'Page not found', indicating no live content was served at the time of analysis, and the domain is currently offline. The domain appears on one security blocklist, PhishDestroy, which flagged it. VirusTotal scanned the domain with 93 vendors and found zero current detections; however, an absence of detections does not confirm safety. Google Safe Browsing and AlienVault OTX results are not provided in the available intelligence, so their status remains unknown.

No specific brand or scam kit has been identified from the page title or known data. Defenders should treat this domain as suspicious due to its appearance on a phishing blocklist, generic hosting infrastructure, and lack of legitimate content. Further monitoring is recommended, and the domain should be blocked at the network level until cleared. If it resurfaces with active content, additional analysis of the hosted material will be necessary to confirm the threat type.