mailer5-kit[.]mdbgo[.]io

This report analyzes the domain mailer5-kit.mdbgo.io. The site displayed a page title of "tradeKorea.com: Verified Korean Suppliers and Products," but it was identified as impersonating the Google brand and categorized as a tech support scam. The threat posed is that it likely attempted to deceive users into believing they were interacting with a legitimate service related to Google, potentially to extract sensitive information or payments under false pretenses.

Technical analysis from VirusTotal shows 23 out of 95 security vendors flagged the domain as malicious. It was flagged by ADMINUSLabs, BitDefender, Cluster25, CRDF, and CyRadar, and is listed on 2 blocklists. The domain is hosted on IP address 93.105.88.216, located in Poland, associated with AS50606 Horyzont Technologie Internetowe sp.z.o.o. It was registered through OVH SAS on 2020-10-19. The SSL certificate was issued by Let's Encrypt with identifier R13. Nameservers are dns17.ovh.net and ns17.ovh.net.

The domain is currently DOWN/OFFLINE. GridinSoft trust rating is 0 out of 100, and the DOM risk score is 10. The risk level is considered high due to the confirmed scam type, brand impersonation, and multiple vendor detections, though its offline status mitigates immediate active threat.