gl[.]pcpovo5[.]sa[.]com

gl.pcpovo5.sa.com was observed as part of a generic phishing campaign and is currently taken offline. The domain was registered through Sav.com, LLC and shows a creation date of 25 June 1998. It is hosted on the IPv4 address 178.16.53.103, which resolves to an Autonomous System (AS202412) operated by Omegatech LTD in the Netherlands. The authoritative name servers are ns1.centralnic.net through ns4.centralnic.net, indicating use of the CentralNic infrastructure. No TLS certificate is presented for the host, meaning communications occur over plain HTTP.

Analysis on VirusTotal indicates that nine out of ninety‑three scanning engines have reported the domain as malicious, and the domain appears on a single external blocklist. The site’s HTTP response contains the page title “Site is created successfully!”, which provides no indication of the intended victim‑facing content. Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed as blocked by PhishDestroy. The overall risk assessment is elevated, reflecting the combination of vendor detections, blocklist presence, and the absence of encryption. Publicly available intelligence does not reveal the specific phishing lure, target brands, or the underlying malicious kit.

Consequently, defenders cannot attribute the campaign to a particular fraud vector beyond the generic phishing label. Organizations should continue to block the domain at network perimeters, enforce HTTPS‑only policies, and monitor for any outbound connections to the associated IP address. Additional threat‑intel sources should be queried for potential indicators of compromise that may be tied to the same hosting infrastructure. Continuous re‑evaluation is advised in case the domain is re‑activated.