hf[.]qylp[.]sa[.]com

Analysis of the domain hf.qylp.sa.com indicates that it is currently offline but retains characteristics typical of a phishing infrastructure. The domain resolves to the IPv4 address 178.16.53.103, which is registered to AS202412 Omegatech LTD and geolocated in the Netherlands. The hosting provider is identified by the IP ownership, and the domain’s authoritative name servers are ns1.centralnic.net through ns4.centralnic.net, all of which are operated by CentralNic. Registration records show the domain was created on June 25, 1998 and was registered through Sav.com, LLC. No SSL certificate is present, and the site returns the page title “Site is created successfully!” when accessed, suggesting a placeholder or test page rather than a fully deployed credential‑harvesting portal.

Threat intelligence sources have flagged the domain on a single security blocklist, and it is explicitly blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious use. VirusTotal analysis reports that four of ninety‑three scanning engines have identified the domain as malicious, providing additional corroboration of its phishing intent.

Uncertainty remains regarding the current content of the site because it is offline and no SSL/TLS negotiation occurs, limiting visibility into any potential credential‑capture mechanisms. Defenders should continue to enforce blocklisting of the domain and its associated IP address across perimeter defenses, DNS filtering, and endpoint protection suites. Monitoring of the hosting ASN for future activity and periodic re‑scanning of the domain when it becomes reachable are recommended to capture any evolution of the threat.