sehakom[.]com

This domain, sehakom.com, is currently under investigation for operating as a fake online pharmacy phishing site targeting users in Saudi Arabia. Analysis indicates the domain impersonates legitimate healthcare services, presenting itself as an online medication platform with Arabic-language content ('SehaКom — أدوية أونلاين في السعودية'). The threat type is classified as brand impersonation with phishing intent, likely designed to harvest personal and financial information from victims seeking pharmaceutical products. Infrastructure analysis reveals the domain was registered on June 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to IP address 188.114.97.3 and has been flagged in 1 threat intelligence pulse on AlienVault OTX. Despite its suspicious characteristics, the domain remains undetected by security vendors, with 0 of 95 VirusTotal engines currently flagging it as malicious. The page title and content suggest a focus on Arabic-speaking users, with potential ties to fraudulent payment collection or credential theft. Current status shows the domain remains active and unblocked by most security platforms. Organizations are advised to implement immediate network-level blocking for 188.114.97.3 and sehakom.com at the DNS and proxy layers. Security teams should monitor for connections to this IP and domain, particularly from healthcare or retail sectors. End users should be alerted to verify pharmacy websites through official Saudi health ministry channels before entering any personal or payment information. Given the domain's recent creation and lack of detection, enhanced monitoring of related infrastructure is recommended.