hf[.]nulqmj3[.]za[.]com

Analysis of the domain hf.nulqmj3.za.com indicates elevated risk of phishing activity based on observable infrastructure and detection data. The domain, registered through Sav.com, LLC, was created on March 24, 1998, though recent malicious activity suggests potential compromise or repurposing of an older domain. It resolves to the IP address 178.16.53.103, hosted under AS202412 (Omegatech LTD) in the Netherlands. No SSL certificate is present, increasing susceptibility to interception and reducing user trust indicators. Nameserver records point to ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, and ns4.centralnic.net, consistent with CentralNic’s infrastructure, which is frequently leveraged for both legitimate and malicious subdomain registrations.

The page title, 'Site is created successfully!', is a generic placeholder commonly associated with newly provisioned or hastily deployed phishing pages, suggesting the domain was recently activated for malicious use. Detection data from security vendors provides further evidence of compromise. As of the latest scan, 13 of 93 security vendors on VirusTotal flagged the domain as malicious. Additionally, the domain appears on one security blocklist and is explicitly blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, reinforcing the assessment of high risk.

While the domain is currently offline, its prior resolution and detection history indicate it was actively used in a phishing campaign. Defenders should treat this domain as compromised and prioritize blocking both the domain and its resolving IP (178.16.53.103) at the network level. Given the absence of SSL and the use of a known hosting provider for malicious activity, monitoring for similar subdomains under za.com or other CentralNic-managed zones is recommended. No specific brand or scam type is identified in the available data, limiting further attribution beyond generic phishing classification.