al-bilad-ksa[.]com

Analysis indicates that www.al-bilad-ksa.com was registered on 15 April 2026 through Hostinger operations, UAB. The domain resolves to the IP address 216.150.16.1, which belongs to Vercel, Inc. in the United States. DNS resolution is handled by artemis.dns-parking.com and hermes.dns-parking.com, typical of parking services. The site employed a TLS certificate issued by Let’s Encrypt (R13) and advertised HSTS, suggesting an attempt to present a legitimate HTTPS presence. Front‑end fingerprints show Node.js, React, Next.js, Webpack and Vercel hosting, all consistent with modern web application stacks.

The page title returned in HTTP responses is "مؤسسة البلاد الحديثة للإلكترونيات", an Arabic phrase translating to "Al‑Bilad Modern Electronics Company". The domain appears on a single security blocklist and is listed as blocked by PhishDestroy, indicating at least one security provider has classified it as malicious. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating. VirusTotal records show the domain was scanned by 94 vendors with no detections reported at the time of analysis, but the absence of detections does not constitute evidence of safety.

The domain is currently offline, which hampers real‑time verification of content but does not remove the historical indicators of phishing intent. Defenders should continue to block traffic to the resolved IP address, enforce DNS sink‑holing for the associated nameservers, and monitor for any re‑appearance of the domain or related subdomains. Additional scrutiny of any URLs that reference the Arabic page title is advised, as the title aligns with a typical lure used in credential‑harvesting campaigns targeting Arabic‑speaking users. Ongoing observation of threat‑intel feeds for new listings or changes to the blocklist status is recommended.