gl[.]ncxdyu2[.]sa[.]com

Analysis indicates that gl.ncxdyu2.sa.com is currently offline but was previously identified as a high‑risk generic phishing domain. The site resolved to the IPv4 address 178.16.53.103, which is registered to the Netherlands under ASN 202412 owned by Omegatech LTD. No TLS certificate was observed, meaning all traffic would have been unencrypted. The domain was created on 25 June 1998 through the registrar Sav.com, LLC and is served by the four centralnic.net name servers.

Google Safe Browsing listed the domain under two social‑engineering entries, and the PhishDestroy blocklist also flags it. In addition, one independent security blocklist includes the host, and a VirusTotal scan showed 14 of 93 scanners labeling the domain as malicious. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The only visible page title retrieved was “Site is created successfully!”, which does not provide any insight into the intended fraudulent content.

Because the domain is offline, active exploitation cannot be confirmed at this time, but the combination of blocklist listings, Safe Browsing flags, and low trust score suggests that the infrastructure was used for credential‑harvesting or similar social‑engineering campaigns. Defenders should continue to block the IP address 178.16.53.103 at perimeter devices, add gl.ncxdyu2.sa.com to URL filtering and phishing‑protection lists, and monitor any future DNS resolution attempts. Given the age of the registration, the domain could be re‑activated, so periodic re‑validation of its status is recommended. Analysts should also review any recent outbound traffic from internal hosts for connections to this host while it was active, and consider forensic collection of logs that reference the domain or IP.