gl[.]ofatfk3[.]sa[.]com

Analysis of gl.ofatfk3.sa.com shows a high‑risk generic phishing infrastructure that has been taken offline as of the report date, July 23, 2026. The domain was originally registered on June 25, 1998 through Sav.com, LLC and resolves to the IPv4 address 178.16.53.103, which is allocated to AS202412 Omegatech LTD in the Netherlands. No TLS certificate is presented for the host, indicating that communications occur over plain HTTP. The authoritative name servers are ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, and ns4.centralnic.net, all operated by CentralNIC. A web request to the site returned the page title "Site is created successfully!", but no additional content has been captured.

The domain appears on a single security blocklist and is actively blocked by PhishDestroy. Google Safe Browsing classifies the URL as a social‑engineering threat, reinforcing the phishing assessment. VirusTotal scans show that 12 of 93 security vendors have flagged the domain, reflecting a moderate detection density across scanning engines. Gridinsoft’s trust scoring system assigns a score of 0 out of 100, indicating an extremely low trust level.

While the offline status limits immediate observation, the combination of an older registration, a Dutch‑based hosting ASN, lack of encryption, multiple vendor detections, and blocklist presence suggests a deliberately crafted phishing landing page that was likely used to harvest credentials or deliver malicious payloads. Defenders should continue to enforce block rules for the IP 178.16.53.103, monitor for any re‑activation of the domain or its name servers, and incorporate the domain into threat‑intel feeds. Network traffic to the associated IP should be logged and inspected, and any user‑initiated connections to the URL should be denied or redirected to a warning page. Ongoing vigilance is advised because the infrastructure could be repurposed under a different subdomain or similar naming scheme.