o0[.]dmztat1[.]sa[.]com

Analysis indicates that the domain o0.dmztat1.sa.com is a confirmed credential-harvesting phishing site, currently offline as of July 25, 2026. The domain, registered on June 25, 1998, through Sav.com, LLC, resolves to the IP address 178.16.53.103, hosted under AS202412 (Omegatech LTD) in the Netherlands. The domain lacks an SSL certificate, increasing the likelihood of unencrypted credential transmission if active. Nameservers are provided by CentralNic (ns1.centralnic.net through ns4.centralnic.net), a common infrastructure provider for both legitimate and malicious domains.

Detection data reveals elevated risk: 11 of 93 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist, including PhishDestroy. The page title, 'Site is created successfully!', is a generic placeholder often associated with recently deployed phishing kits or default landing pages for newly configured malicious infrastructure. Gridinsoft assigns a trust score of 0/100, further corroborating its classification as high-risk. While the domain's long registration period (spanning over 28 years) may initially appear anomalous for phishing activity, this does not preclude compromise or abuse of a dormant or repurposed domain.

The absence of SSL, combined with the hosting provider's history of abuse reports, aligns with known phishing infrastructure patterns. Defenders should treat this domain as compromised and prioritize blocking at the DNS, IP, and URL levels. Network monitoring should include retrospective analysis for any prior connections to 178.16.53.103 or related subdomains under dmztat1.sa.com. Given the domain's current offline status, further forensic analysis may be limited, but historical WHOIS and passive DNS data should be reviewed for additional indicators of compromise or related campaigns.