df[.]oyfive3[.]sa[.]com

This domain, df.oyfive3.sa.com, is currently flagged as a generic phishing site. The domain resolves to the IPv4 address 178.16.53.103, which belongs to AS202412 operated by Omegatech LTD in the Netherlands. DNS resolution uses the CentralNic name server cluster (ns1‑ns4.centralnic.net). The registration record shows the domain was created on 25 June 1998 through Sav.com, LLC, and the service has been taken offline. No TLS certificate is presented, indicating the site is reachable only via plain HTTP.

Gridinsoft assigns a trust score of 0 out of 100, suggesting extreme lack of reputation. VirusTotal analysis reports that eleven of ninety‑three scanning engines have classified the domain as malicious, reinforcing the phishing designation. The domain appears on one public blocklist and is explicitly blocked by the PhishDestroy service. The only visible page title returned during the last probe reads “Site is created successfully!”.

No further page content has been captured, leaving the exact lures or credential‑collection mechanisms unknown. Given the convergence of low trust scoring, multiple vendor detections, blocklist inclusion, and the absence of encryption, the infrastructure is highly indicative of a phishing operation. Defenders should deny all outbound connections to the address, add the domain and its IP to network‑level deny lists, and monitor for any residual references in email or URL filtering logs. Continuous re‑scanning is advised in case the site becomes active again, and any observed malicious payloads should be shared with threat‑intel communities to improve collective detection.