lg[.]nqoxur2[.]sa[.]com

Analysis of lg.nqoxur2.sa.com reveals a malicious infrastructure consistent with a phishing campaign. The domain resolves to the IPv4 address 178.16.53.103, which belongs to AS202412 operated by Omegatech LTD and is geolocated to the Netherlands. No TLS certificate is presented, indicating the site operates only over HTTP. The domain is registered through Sav.com, LLC, with a creation timestamp of 25 June 1998, and is served by the four Centralnic.net name servers (ns1‑ns4.centralnic.net). The page title returned by the HTTP endpoint is “Site is created successfully!”, a generic message that does not disclose any brand or service and suggests a placeholder page rather than a functional login portal.

Reputation services flag the domain as hostile: Gridinsoft rates it at 0 / 100, and it appears on one public security blocklist. Eight of ninety‑three VirusTotal scanners raise detections, confirming that multiple antivirus engines have observed malicious characteristics. The domain is also listed on the PhishDestroy blocklist, reinforcing its classification as a phishing vector. The current online status is reported as offline, which may be a temporary takedown or a deliberate shutdown after detection.

Because the underlying infrastructure—static IP, lack of encryption, and low trust scores—remains unchanged, the domain could be re‑activated by the threat actor. Defenders should continue to block the IP 178.16.53.103 at network perimeter devices, enforce DNS filtering for lg.nqoxur2.sa.com, and monitor the Centralnic name server set for any rapid DNS changes. Incident response teams should treat any future resolution of the domain as a high‑confidence phishing indicator and apply appropriate containment measures. Additional analysis of HTTP responses, payloads, and potential credential‑stealing pages is recommended if the site becomes reachable again.