df[.]nchodotcom[.]sa[.]com

This domain, df.nchodotcom.sa.com, is flagged as a generic phishing threat with elevated risk. Infrastructure analysis reveals it resolved to IP 178.16.53.103, hosted on AS202412 (Omegatech LTD) in the Netherlands, with no SSL certificate detected. The domain was registered through Sav.com, LLC on June 25, 1998, though this creation date may reflect a repurposed or expired domain rather than recent malicious registration. The page title 'Site is created successfully!' suggests a placeholder or staging page, which is atypical for operational phishing sites but may indicate preliminary setup or a low-effort scam.

Detection data shows 5 of 93 security vendors on VirusTotal flagged the domain, while PhishDestroy has actively blocked it. The domain appears on one security blocklist, and Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. Nameservers (ns1-4.centralnic.net) are consistent with CentralNic infrastructure, which is frequently used for both legitimate and malicious domains. Defenders should treat this domain as compromised or malicious.

The absence of SSL and the placeholder page title do not rule out phishing activity, as the domain may have been taken offline before full deployment or could be part of a broader campaign. Blocklist enforcement is recommended, particularly given the VirusTotal detections and PhishDestroy's classification. Further investigation into associated IPs (178.16.53.103) and hosting provider (AS202412) may reveal related threats. No specific brand impersonation is confirmed from the available data, so monitoring for future activity under this domain or similar subdomains is advised.