coverage[.]ltebqgnxcvyn[.]sa[.]com

The domain coverage.ltebqgnxcvyn.sa.com was created on 25 June 1998 and is currently listed as offline. DNS resolution points to the IPv4 address 66.85.47.121, which belongs to Host4Geeks LLC in the United States (AS393960). All four authoritative name servers – ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, and ns4.centralnic.net – resolve to the same hosting infrastructure. No TLS certificate is presented for the host, indicating that the site operates only over HTTP. The HTTP response includes the page title "Index of /", suggesting a directory listing rather than a purpose‑built phishing landing page, but the actual content has not been captured for further analysis.

The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. Reputation scoring systems are uniformly negative: Gridinsoft assigns a trust score of 0 out of 100, while Scamadviser reports a trust score of 1 out of 100. VirusTotal analysis shows that 15 of 95 antivirus or URL scanning engines flagged the domain, reinforcing its malicious classification. Registration was performed through Sav.com, LLC, without any indication of a legitimate business purpose.

Given the combination of a low trust rating, multiple detection engine flags, and blocklist presence, the domain should be added to network deny lists and its associated IP address 66.85.47.121 monitored for any traffic anomalies. Defenders should also ensure that any user agents attempting to access the HTTP directory listing are logged and that outbound connections to the identified hosting provider are scrutinized. Because the site is offline, further forensic collection is limited, and the exact phishing payload or target brand remains unknown. Continuous observation of related hostnames and future DNS changes is advised to detect potential re‑use of the same infrastructure for new campaigns.