lg[.]qtzyuw7[.]sa[.]com

Analysis indicates that the domain lg.qtzyuw7.sa.com is associated with a high-risk phishing campaign, currently offline as of July 24, 2026. The domain was registered on June 25, 1998, through Sav.com, LLC, though its creation date does not align with recent malicious activity, suggesting potential domain repurposing. Infrastructure analysis reveals resolution to the IP address 178.16.53.103, hosted on AS202412 (Omegatech LTD) in the Netherlands. No SSL certificate is present, increasing susceptibility to interception or manipulation of unencrypted traffic.

Detection metrics confirm malicious classification: 13 of 93 security vendors on VirusTotal flag the domain, while Google Safe Browsing explicitly labels it as engaging in social engineering. The domain appears on at least one security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk status. The observed page title, 'Site is created successfully!', is consistent with placeholder content often deployed during initial phishing site setup or following takedowns.

Nameserver records point to ns1.centralnic.net through ns4.centralnic.net, indicating use of a large-scale DNS provider commonly leveraged for both legitimate and malicious domains. The absence of a valid SSL certificate and the generic page title suggest the campaign may have been interrupted or remains in an early deployment phase. Defenders should treat this domain as compromised and prioritize blocking resolutions to 178.16.53.103, along with monitoring for related subdomains under sa.com. Further investigation into Omegatech LTD’s hosting patterns may reveal additional linked infrastructure.