lg[.]nchodotcom[.]sa[.]com

The domain lg.nchodotcom.sa.com was observed hosting a page whose HTML title reads "Site is created successfully!". No TLS certificate was presented, indicating that connections are unencrypted. DNS resolution points to 178.16.53.103, an address located in the Netherlands and announced by AS202412 belonging to Omegatech LTD. The domain is registered through Sav.com, LLC and its creation date is recorded as 25 June 1998, which suggests the name may be a reused or hijacked legacy label rather than a newly registered phishing infrastructure. The authoritative name servers are the four centralnic.net hosts, a common configuration for many registered domains.

VirusTotal analysis shows that six of ninety‑three scanned scanners flagged the domain, reflecting a modest but non‑trivial detection rate. Independent reputation scoring from Gridinsoft rates the domain at 0 out of 100, the lowest possible trust value. The domain is listed on a single external blocklist and is actively blocked by the PhishDestroy service. The current operational status is offline, as the host has been taken down.

Given the observable indicators—unsecured HTTP, low trust score, multiple vendor detections, and inclusion on a phishing‑focused blocklist—the domain should be treated as malicious. Defenders are advised to add the IP address 178.16.53.103 to network deny lists, enforce DNS blocking of lg.nchodotcom.sa.com, and monitor for any re‑appearance of the domain or its hosting infrastructure. Continued observation of the registrar and name‑server set may reveal future repurposing attempts. Until further evidence is gathered, the domain remains classified as an elevated‑risk generic phishing site.