o0[.]ofmivu0[.]sa[.]com

Analysis of the domain o0.ofmivu0.sa.com indicates elevated risk of phishing activity, with infrastructure characteristics commonly associated with fraudulent operations. The domain, registered through Sav.com, LLC on June 25, 1998, presents an unusual discrepancy between its long-standing registration date and recent malicious detection. As of July 25, 2026, the domain resolves to the IP address 178.16.53.103, hosted on AS202412 (Omegatech LTD) in the Netherlands. Nameservers are provided by CentralNic (ns1.centralnic.net through ns4.centralnic.net), a configuration often observed in domains used for transient phishing campaigns.

Security vendor detections on VirusTotal report 12 of 93 engines flagging the domain as malicious, though the specific nature of the threat—whether credential harvesting, malware distribution, or other fraudulent activity—remains unconfirmed due to the absence of SSL certification and the generic page title 'Site is created successfully!' No brand impersonation or scam type is evident from available metadata, and the exact content of the phishing page has not been analyzed. The domain appears on one security blocklist and is blocked by PhishDestroy, further supporting its classification as a likely phishing resource. Defenders should note the domain's current offline status, though this does not preclude future reactivation under the same or similar infrastructure.

The combination of a long-standing registration, recent malicious detections, and hosting on a provider frequently associated with phishing (Omegatech LTD) warrants continued monitoring. Network-level blocking of 178.16.53.103 and associated subdomains is recommended for organizations seeking to mitigate exposure. Given the lack of SSL and the generic page title, automated detection rules targeting domains with these characteristics may improve early identification of related threats.