gl[.]qjbliz7[.]sa[.]com

The domain gl.qjbliz7.sa.com is currently taken offline but exhibits several indicators consistent with a generic phishing infrastructure. Registration data shows the domain was created on 25 June 1998 and was registered through Sav.com, LLC. The authoritative name servers are ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, and ns4.centralnic.net, all of which are standard CentralNic services. DNS resolution points to the IPv4 address 178.16.53.103, which belongs to AS202412 Omegatech LTD and is geolocated in the Netherlands. No SSL certificate is presented for the host, indicating that communications would have been unencrypted if the site were reachable.

The page title returned from the HTTP response is "Site is created successfully!", a generic message that provides no functional context. Gridinsoft assigns a trust score of 0 out of 100, suggesting a high confidence of malicious intent. The domain appears on one public blocklist and is specifically listed as blocked by PhishDestroy. VirusTotal analysis shows that 12 of 93 scanned security vendors flagged the domain, reinforcing the suspicion of abuse.

While the offline status limits real‑time observation, the combination of a low trust score, blocklist presence, vendor detections, and the absence of TLS strongly indicates a phishing operation. Defenders should continue to block the domain at perimeter devices, monitor DNS queries for the associated IP and name servers, and consider adding the IP address to reputation‑based deny lists. Ongoing surveillance of any future re‑registration attempts is advised, given the historical age of the registration and the potential for reuse in new campaigns.