gl[.]qigame[.]sa[.]com

gl.qigame.sa.com was observed hosting a generic phishing campaign. The domain is registered through Sav.com, LLC and was originally created on June 25, 1998. Current DNS resolution points to 178.16.53.103, an address allocated to AS202412 (Omegatech LTD) in the Netherlands. No TLS certificate is presented, indicating the site operates over plain HTTP only. The page title returned by the server is “Site is created successfully!”.

VirusTotal records show that 15 of 93 scanned security vendors flagged the domain as malicious, and Google Safe Browsing categorises it as “social engineering”. Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed on one public blocklist. PhishDestroy has also blocked the host. Nameservers are ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, and ns4.centralnic.net.

The site status is reported as offline at the time of analysis. Evidence confirms that the infrastructure is consistent with known phishing infrastructure, but the specific payload or targeted brand is not disclosed in the available data. Defenders should add 178.16.53.103 and gl.qigame.sa.com to block and monitoring rules, enforce TLS inspection for outbound HTTP to this host, and consider sharing the indicators with upstream threat feeds. Continuous re‑evaluation is advised in case the domain is re‑activated.