hf[.]ofmivu0[.]sa[.]com

Analysis as of July 23, 2026 indicates that the domain hf.ofmivu0.sa.com is currently offline but exhibits multiple indicators consistent with a high‑risk phishing infrastructure. DNS resolution points to the IP address 178.16.53.103, which is registered to AS202412 Omegatech LTD in the Netherlands. The host provides no TLS certificate, leaving all HTTP traffic unencrypted. Authoritative nameservers are ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net and ns4.centralnic.net, a configuration commonly observed in domains used for malicious campaigns.

The only retrieved page title reads “Site is created successfully!”, offering no legitimate content and suggesting a placeholder page often employed during rapid deployment. Reputation services flag the domain heavily: Gridinsoft assigns a trust score of 0 / 100, Google Safe Browsing classifies it as social engineering, and VirusTotal reports that 12 of 93 security vendors have flagged the host. The domain appears on a single known security blocklist and has been explicitly blocked by PhishDestroy. Registration data shows the domain was created on June 25 1998 through Sav.com, LLC, indicating a long‑standing registration that may be leveraged to evade age‑based heuristics.

Although the site is offline, the combination of a low‑trust score, multiple vendor detections, and association with a known blocklist warrants immediate defensive action. Organizations should add hf.ofmivu0.sa.com and its resolving IP 178.16.53.103 to network‑level deny lists, monitor for any re‑activation, and ensure that email filters treat any messages referencing this domain as malicious. Further investigation is limited by the lack of live content and the absence of SSL, so continuous scanning is recommended to capture any future changes.