hf[.]oyxqii0[.]sa[.]com

The domain hf.oyxqii0.sa.com is currently offline but historical data indicates it was used for a generic phishing campaign. Google Safe Browsing classifies the site as social engineering, and it appears on one security blocklist. PhishDestroy has also blocked the domain. VirusTotal reports that 12 of 93 scanned security vendors flagged the domain, indicating a moderate detection rate. The domain was registered through Sav.com, LLC and was originally created on June 25, 1998.

DNS resolution points to the IP address 178.16.53.103, which belongs to AS202412 Omegatech LTD located in the Netherlands. The authoritative nameservers are ns1.centralnic.net through ns4.centralnic.net. No SSL certificate was observed, meaning traffic would have been unencrypted. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent.

The only visible page title retrieved was "Site is created successfully!", which offers no indication of legitimate content. Because the site is offline, direct verification of current payloads is not possible, and the exact phishing template or targeted brand remains unknown. Defenders should continue to block the domain at perimeter filters, update intrusion detection signatures with the observed IP and DNS records, and monitor for any re‑hosting attempts that reuse the same infrastructure. The lack of TLS and the low trust score further suggest that any attempted connections are likely malicious and should be treated with high priority.