gl[.]ntiqshop[.]sa[.]com

Analysis indicates that the domain gl.ntiqshop.sa.com was created on 25 June 1998 and currently resolves to the IPv4 address 178.16.53.103, which is assigned to AS202412 Omegatech LTD in the Netherlands. The authoritative name servers are ns1.centralnic.net through ns4.centralnic.net, suggesting registration with CentralNic. The registrar listed is Sav.com, LLC. No TLS certificate was observed, meaning the site operates solely over HTTP. A public scan on VirusTotal returned 12 positive detections out of 93 submitted security vendors, reinforcing the classification as a malicious resource.

Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating. The site’s HTML title reports “Site is created successfully!”, but the content has not been publicly reviewed, so the exact phishing payload remains unknown. The domain is presently offline and has been taken down, yet historical records show it was blocked by the PhishDestroy feed and appears on a single external blocklist. Because the hosting infrastructure is associated with a known European ISP and the domain age is extensive, attackers may be leveraging legacy registrations to evade rapid takedown.

Defenders should continue to block the resolved IP 178.16.53.103, add gl.ntiqshop.sa.com to local deny lists, and monitor for any re‑registration or similar sub‑domains using the same name server set. Ongoing vigilance is recommended, as the lack of SSL and the low trust score suggest future attempts may surface with minimal modifications. At present, the limited public evidence prevents a detailed description of the phishing content, but the combined vendor detections, blocklist inclusion, and trust score provide sufficient confidence to treat the domain as a confirmed phishing threat.