hf[.]qxzqqp6[.]sa[.]com

Analysis of the domain hf.qxzqqp6.sa.com indicates it is a high-risk generic phishing site that was taken offline on or before July 24, 2026. The domain was registered through Sav.com, LLC and uses nameservers ns1.centralnic.net through ns4.centralnic.net, a pattern consistent with bulk-registered subdomains under the .sa.com namespace. It resolved to the IP address 178.16.53.103, hosted in the Netherlands under AS202412 (Omegatech LTD), a network previously associated with malicious infrastructure. No SSL certificate was present, increasing the likelihood of interception or impersonation. The domain appears on one security blocklist (PhishDestroy) and is flagged by Google Safe Browsing for social engineering.

Thirteen of 93 security vendors on VirusTotal detected the domain as malicious, though the specific payload or lure remains unconfirmed. The page title, 'Site is created successfully!', suggests a placeholder or automated deployment, often seen in newly spun-up phishing infrastructure before content is fully staged. The domain was originally created on June 25, 1998, though this likely reflects the registration date of the parent domain sa.com rather than the subdomain itself. Defenders should treat this domain as compromised infrastructure.

While currently offline, the subdomain may resurface under the same or similar naming conventions. Monitoring for re-registration or DNS changes under the .sa.com namespace is recommended. Network-level blocking of 178.16.53.103 and AS202412 may mitigate residual risk from related campaigns. No brand-specific targeting is evident from available data, and the exact phishing lure remains unanalyzed.