gl[.]nrcwte2[.]sa[.]com

Analysis of gl.nrcwte2.sa.com shows a clear indication of malicious activity consistent with a generic phishing operation. The domain, registered through Sav.com, LLC, was created on June 25, 1998 and is currently offline, as indicated by the status field. DNS resolution points to the IPv4 address 178.16.53.103, which is hosted in the Netherlands and belongs to AS202412 Omegatech LTD. No SSL certificate is presented for the host, meaning all HTTP traffic would be unencrypted and vulnerable to interception.

The page title returned by the server is "Site is created successfully!", a generic message that offers no insight into the intended victim interaction and suggests the site may have been used as a placeholder or drop‑in page for phishing payloads. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low reputation of the host. VirusTotal scans have identified the domain as malicious in 11 of 93 security vendor engines, indicating that multiple independent detection products have flagged it. The domain appears on a single external security blocklist and is specifically listed as blocked by PhishDestroy, confirming that at least one dedicated anti‑phishing service has taken action against it.

Nameservers are provided by centralnic.net (ns1‑ns4.centralnic.net), a common infrastructure for many unrelated domains, which does not provide any mitigating context. While the offline status limits immediate probing, defenders should still update their URL filtering and DNS sinkhole rules to include gl.nrcwte2.sa.com, enforce blocklisting in web proxies, and monitor for any future re‑registration attempts. Continuous telemetry from endpoint protection and network monitoring should be correlated with the observed 11 vendor detections to catch any residual artifacts that may have propagated before the takedown.