df[.]qrtnln3[.]sa[.]com

This domain, df.qrtnln3.sa.com, has been observed in a generic phishing campaign and is currently taken offline. The registrar record shows the domain was created on June 25, 1998 and is registered through Sav.com, LLC. Infrastructure analysis reveals that the domain resolves to the IPv4 address 178.16.53.103, which is hosted in the Netherlands and belongs to autonomous system AS202412 operated by Omegatech LTD. No TLS certificate is presented, indicating that the site served only HTTP content. The authoritative name servers are ns1.centralnic.net through ns4.centralnic.net, which are typical of CentralNic‑managed domains.

The page title returned from the live host was “Site is created successfully!”, a generic message that offers no insight into the intended victim interaction. Trust scoring from Gridinsoft assigns a zero‑point rating out of 100, reflecting a high likelihood of malicious use. VirusTotal scans report that ten out of ninety‑three antivirus and URL‑reputation engines flagged the domain, providing independent confirmation of its suspicious nature. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed, further corroborating its classification as a phishing resource.

Because the site is offline, dynamic analysis of payloads or redirects is not possible, leaving the exact phishing technique and targeted brand unknown. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the host, and consider adding the IP address 178.16.53.103 to reputation lists. Additional mitigation steps include reviewing outbound traffic for connections to this address, updating web‑filter rules to deny HTTP traffic to the domain, and watching for new subdomains under the same registrar that may be leveraged in future campaigns. Ongoing vigilance is advised given the low trust score, multiple vendor detections, and active blocklist listings.