df[.]oiftuk2[.]sa[.]com

The domain df.oiftuk2.sa.com was observed to resolve to the IPv4 address 178.16.53.103, which is registered to AS202412 Omegatech LTD and geolocated in the Netherlands. Registration data indicate the domain was created on June 25, 1998 and is held through Sav.com, LLC. The authoritative name servers are ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, and ns4.centralnic.net. No TLS certificate was presented for the host, confirming the absence of HTTPS support at the time of analysis.

An HTTP request returned a page whose title reads "Site is created successfully!", providing no further functional context. The site has been classified as a generic phishing operation and is currently marked as offline; it was taken offline after identification and is listed as blocked by PhishDestroy. The domain appears on a single security blocklist and received a Gridinsoft trust score of 0 out of 100, indicating a high confidence of malicious intent.

VirusTotal scanned the domain and five of ninety‑three security vendors flagged it as malicious, reinforcing the suspicion. Defenders should prioritize adding df.oiftuk2.sa.com and its resolving IP 178.16.53.103 to network deny lists, monitor for any re‑registration or DNS changes, and ensure outbound traffic to the host is prohibited. Continuous re‑scanning through multi‑vendor engines is advised to capture any future alterations to the site’s content or infrastructure.