df[.]osesyo2[.]sa[.]com

Analysis of df.osesyo2.sa.com indicates that the domain is currently offline but continues to be flagged by multiple security services as a phishing vector. The domain was registered through Sav.com, LLC on June 25, 1998 and resolves to the IPv4 address 178.16.53.103, which is assigned to AS202412 Omegatech LTD in the Netherlands. No TLS certificate is present, meaning any traffic would be unencrypted HTTP. The public page title returned when the site was reachable reads “Site is created successfully!”, which offers no indication of a legitimate service and is consistent with placeholder content often used in malicious deployments. Gridinsoft assigns a trust score of 0 out of 100, effectively marking the domain as completely untrusted.

VirusTotal scans have returned detections from six of ninety‑three AV engines, reinforcing the suspicion of malicious intent. The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service, confirming that at least one anti‑phishing platform has taken mitigation steps. Nameserver records point to the centralnic.net cluster (ns1‑ns4.centralnic.net), a common configuration for domains that are not tied to a dedicated hosting provider. The combination of a zero‑trust score, multiple vendor detections, lack of SSL, and the generic “Site is created successfully!” title suggests that the domain is being used to host a phishing landing page or a placeholder for credential‑harvesting infrastructure.

Because the site is offline, real‑time content analysis is not possible, and the exact phishing template or targeted brand cannot be confirmed. Defenders should continue to block the domain at perimeter filters, update URL filtering lists with the observed IP address 178.16.53.103, and monitor any future resolution attempts to this host. Additional reconnaissance, such as passive DNS monitoring for resurrected subdomains or new A records, may reveal re‑activation attempts.