df[.]ncvpqc8[.]sa[.]com

Analysis of df.ncvpqc8.sa.com shows a high‑risk generic phishing infrastructure that is currently offline. The domain resolves to the IPv4 address 178.16.53.103, which is assigned to AS202412 (Omegatech LTD) in the Netherlands. Registration data indicates the domain was created on June 25, 1998 and was purchased through Sav.com, LLC, using the centralnic.net name server set (ns1‑ns4.centralnic.net). No SSL certificate is present, meaning traffic is unencrypted.

Reputation services flag the site heavily: it appears on one known security blocklist and is listed by PhishDestroy as blocked. VirusTotal scans report that 15 of 93 security vendors have identified the domain as malicious, and Google Safe Browsing classifies it under social engineering, confirming a phishing intent. Gridinsoft assigns a trust score of 0 out of 100, further underscoring the lack of legitimacy.

The only observable page content is the title “Site is created successfully!”, which provides no indication of a legitimate service and is typical of placeholder pages used in phishing campaigns. Defenders should continue to block the domain at DNS and firewall layers, monitor the associated IP range for any re‑use, and update detection signatures to include the observed hostnames and name server pattern. Because the site is offline, active takedown verification is not possible, but the historical evidence warrants maintaining the domain on blocklists and informing end‑users to avoid any links that reference df.ncvpqc8.sa.com.