lg[.]qigame[.]sa[.]com

On July 23, 2026, analysis of the domain lg.qigame.sa.com confirms that it is currently offline but was previously identified as a high‑risk phishing site. The domain resolves to the IPv4 address 178.16.53.103, which is allocated to Netherlands‑based AS202412 (Omegatech LTD). The hosting infrastructure is served by four CentralNic nameservers (ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, ns4.centralnic.net). Registration records show the domain was created on June 25, 1998 and was purchased through the registrar Sav.com, LLC. No TLS certificate was observed, indicating that the site operated without HTTPS protection. VirusTotal reports that 16 of 93 scanned security vendors flagged the domain, providing an early indication of malicious activity.

Gridinsoft assigned a trust score of 0 out of 100, reinforcing the suspicion. Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on at least one public blocklist. PhishDestroy has also listed the domain as blocked. The only visible page element captured during the brief crawl was the title “Site is created successfully!”, which does not reveal any legitimate branding or functional content.

No additional page content, login forms, or redirection behavior have been disclosed, leaving the specific phishing payload uncertain. Given the combination of multi‑vendor detections, a zero trust score, and confirmation from Google Safe Browsing and PhishDestroy, defenders should continue to block traffic to this host, ensure that any cached DNS entries are purged, and monitor for possible reuse of the underlying IP address or similar sub‑domains. Organizations employing URL filtering, endpoint protection, and threat‑intelligence feeds should incorporate the indicator set (domain, IP, and associated nameservers) into their defensive rules. Ongoing observation of the IP space is advised, as the infrastructure could be repurposed for future campaigns.