hf[.]nqoxur2[.]sa[.]com

Analysis of the domain hf.nqoxur2.sa.com confirms its classification as a generic phishing site, currently offline as of July 25, 2026. The domain resolves to the IP address 178.16.53.103, hosted under AS202412 (Omegatech LTD) in the Netherlands. Registration was facilitated through Sav.com, LLC, with nameservers pointing to ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, and ns4.centralnic.net. The domain was originally created on June 25, 1998, though this date may not reflect recent malicious activity, as phishing domains often leverage aged registrations to evade detection. No SSL certificate is present, increasing the likelihood of interception or manipulation of unencrypted traffic.

The page title, 'Site is created successfully!', suggests a placeholder or default configuration, which is consistent with hastily deployed phishing infrastructure. Detection by security vendors remains limited but notable: seven of ninety-three vendors on VirusTotal flagged the domain as malicious, while PhishDestroy has explicitly blocked it. The domain also appears on at least one security blocklist, and Gridinsoft assigns it a trust score of 0/100, indicating high risk. Defenders should treat this domain as compromised infrastructure.

The lack of SSL, combined with its hosting on a bulletproof provider (Omegatech LTD), aligns with common phishing tactics. While the exact target or phishing kit remains unconfirmed, the domain’s detection history and offline status warrant inclusion in blocklists and monitoring for reactivation. Organizations should verify whether internal systems or users accessed this domain prior to its takedown and assess potential exposure. Given the domain’s age and registrar, defenders should also investigate whether the same infrastructure (IP, nameservers, or registrar account) is being reused for other malicious campaigns.