lg[.]onticapp[.]sa[.]com

lg.onticapp.sa.com was observed hosting a site that returns the title “Site is created successfully!”. The domain is registered through Sav.com, LLC and was originally created on 25 June 1998. Current DNS records point to four CentralNic nameservers (ns1‑ns4.centralnic.net) and resolve to the IPv4 address 178.16.53.103, which is allocated to AS202412 (Omegatech LTD) in the Netherlands. No TLS certificate is presented, indicating that the service is delivered over plain HTTP.

The page receives a Gridinsoft trust score of 0 out of 100, reflecting a lack of credibility. Reputation services have placed the domain on a single security blocklist and Google Safe Browsing classifies it as a social‑engineering threat. VirusTotal analysis shows that 14 of 93 scanning engines flagged the domain, confirming malicious intent. The domain is also listed by PhishDestroy as blocked.

As of the report date, the site is reported offline, but the infrastructure remains observable. The available evidence confirms that the domain is being used for a generic phishing campaign, though the specific target or payload has not been disclosed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host, and consider adding the IP address 178.16.53.103 to threat‑intel feeds. Further investigation is needed to determine whether the underlying server hosts additional malicious content or if the domain is part of a larger campaign.