hf[.]nrcwte2[.]sa[.]com

hf.nrcwte2.sa.com was observed on July 24, 2026 as a generic phishing infrastructure that is currently offline. The domain was created on June 25, 1998 and is registered through Sav.com, LLC. Its authoritative nameservers are ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net and ns4.centralnic.net, all of which are typical of CentralNic‑managed zones. DNS resolution points to the IPv4 address 178.16.53.103, which is announced by AS202412 belonging to Omegatech LTD and geolocated to the Netherlands. No TLS certificate is presented for the host, indicating that the site was served over HTTP only.

The only visible page title returned during the brief online window was “Site is created successfully!”, providing no indication of a targeted brand or login interface. Reputation checks show a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist, specifically PhishDestroy, which has already marked it as malicious. VirusTotal reports that 12 of 93 scanned security vendors flagged the domain, reinforcing the suspicion of malicious activity. The elevated risk rating aligns with the observed evidence, yet the offline status limits further behavioural analysis.

Uncertainty remains regarding the specific phishing payload, target audience, and whether additional infrastructure shares the same IP or nameserver set. Defenders should immediately block both the domain and the associated IP address at perimeter and endpoint controls, monitor for new subdomains under the same registrar or nameserver configuration, and consider adding the host to internal threat‑intel feeds. Continuous re‑evaluation is advised in case the site becomes active again or new indicators emerge.