o0[.]nrcwte2[.]sa[.]com

Analysis of o0.nrcwte2.sa.com indicates that the host is currently offline and has been taken down by the PhishDestroy mitigation service. The domain was originally registered through Sav.com, LLC on June 25, 1998, and continues to use the centralnic.net name server cluster (ns1‑ns4.centralnic.net). DNS resolution points to the IPv4 address 178.16.53.103, which belongs to Autonomous System AS202412 operated by Omegatech LTD in the Netherlands. No Transport Layer Security certificate is presented for the host, confirming that HTTPS connections are not available. The page title returned by the HTTP service is the generic string “Site is created successfully!”, providing no indication of the intended victim brand or lure.

Gridinsoft’s trust scoring system assigns a score of 0 out of 100, reflecting a highly untrusted reputation. VirusTotal reports that 13 of 93 scanned engines flag the domain as malicious, reinforcing the suspicion of phishing or scam activity. The host appears on a single external blocklist and has been flagged by PhishDestroy, indicating that at least one security vendor has taken active mitigation steps. Public Safe Browsing and Open Threat Exchange records were not supplied, so their status cannot be confirmed.

The combination of a low trust score, multiple vendor detections, and the lack of TLS suggests a high likelihood of fraudulent intent, although the specific target brand or credential‑stealing technique remains unknown because no page content has been captured. Defenders should continue to block the domain and its associated IP address at network perimeter devices, update URL filtering policies to include the observed nameservers, and monitor for any re‑registration attempts. Incident response teams should also consider reviewing historic traffic logs for connections to 178.16.53.103 and correlating any associated user credentials that may have been exposed.