df[.]qjbliz7[.]sa[.]com

Analysis of the domain df.qjbliz7.sa.com indicates it was actively used for generic phishing operations prior to being taken offline on July 25, 2026. The domain, registered through Sav.com, LLC on June 25, 1998, exhibits multiple technical indicators of malicious intent. It resolves to the IP address 178.16.53.103, hosted on AS202412 (Omegatech LTD) in the Netherlands, a network frequently associated with fraudulent activity. No SSL certificate was present, increasing the likelihood of plaintext credential interception. The page title 'Site is created successfully!' is consistent with default placeholder text used by threat actors to confirm domain activation before deploying phishing kits.

While the exact content of the phishing page remains unanalyzed, 13 of 93 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist. The domain was blocked by PhishDestroy, further corroborating its classification as a phishing threat. Nameservers (ns1.centralnic.net through ns4.centralnic.net) are legitimate infrastructure providers, but their use does not mitigate the domain's malicious purpose. Defenders should treat this domain as a confirmed phishing resource.

Network-level blocks should be implemented for 178.16.53.103 and the domain itself. Given the domain's age (registered in 1998) and its sudden appearance on blocklists, it is likely part of a larger campaign leveraging older domains for credibility. No brand-specific targeting is evident from the available data, classifying this as a generic credential-harvesting operation. Monitoring for re-activation or related domains under the same nameserver or IP range is recommended.