hf[.]pcpovo5[.]sa[.]com

The domain hf.pcpovo5.sa.com is currently listed as offline. DNS resolution points to the IPv4 address 178.16.53.103, which belongs to the Netherlands and is announced by AS202412 operated by Omegatech LTD. The authoritative name servers are the four CentralNic servers (ns1‑ns4.centralnic.net), indicating the domain is hosted on a generic registrar infrastructure. Registration data show the domain was created on 25 June 1998 through the registrar Sav.com, LLC, and no recent changes have been observed. The site does not serve HTTPS; no SSL/TLS certificate was found, which is typical for many low‑quality phishing deployments.

Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, suggesting the domain is regarded as highly untrusted. VirusTotal has recorded eight detections out of ninety‑three scanning engines, confirming that multiple security vendors consider the host malicious. PhishDestroy has actively blocked the domain and it appears on a single external blocklist, providing additional corroboration of its abusive nature. The only publicly visible page title returned by the web server is “Site is created successfully!”, a generic message that offers no insight into the intended victim‑facing content and is consistent with a placeholder page often used in phishing kits.

Taken together, the evidence points to a domain that has been leveraged for generic phishing campaigns and subsequently taken offline, either by the operators or by takedown actions. The lack of HTTPS, the low trust score, multiple vendor detections, and blocklist listings constitute concrete indicators that threat‑hunting and remediation tools should continue to treat the host as malicious. Defenders should ensure that any recent connections to 178.16.53.103 are flagged, update local and network‑level blocklists with the domain and its IP, and monitor the CentralNic name servers for any re‑registration or new sub‑domains that might be used in future campaigns.