df[.]msqahn6[.]sa[.]com

df.msqahn6.sa.com is currently listed as offline after being taken down, but historical data indicate it was used for a generic phishing campaign. The domain resolves to the IPv4 address 178.16.53.103, which is assigned to AS202412 (Omegatech LTD) in the Netherlands. The hosting infrastructure is served by four Centralnic.net nameservers (ns1‑ns4.centralnic.net). No TLS certificate is present, meaning the site was only reachable over HTTP, which is consistent with many low‑effort phishing deployments. The registrar record shows the domain was created on 25 June 1998 and was registered through Sav.com, LLC, a known registrar for many long‑standing domains.

Detection telemetry shows that 13 of 93 security vendors on VirusTotal flagged the domain, indicating a moderate level of consensus among anti‑malware engines that the site hosted malicious content. Google Safe Browsing also classifies the URL as a social‑engineering threat, and the domain is listed on a single external blocklist and has been explicitly blocked by the PhishDestroy service. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the assessment of high risk. The only visible page title captured before takedown was “Site is created successfully!”, which provides no indication of a legitimate service and suggests a placeholder page often used during site provisioning. Because the site is no longer reachable, direct content analysis is not possible, leaving the exact phishing payload or credential‑harvesting mechanism uncertain.

However, the combination of a non‑TLS endpoint, low trust score, multiple vendor detections, and active blocklist listings strongly suggests the domain was employed to lure victims into a credential‑theft or information‑gathering workflow. Defenders should continue to block the IP address 178.16.53.103 at the network perimeter, add df.msqahn6.sa.com to DNS‑based blacklists, and monitor for any resurgence of the domain or related subdomains.