mandybio[.]com

Analysis as of July 27 2026 indicates that the domain www.mandybio.com remains active and is being used in a generic phishing campaign. The domain was registered on August 06 2024 through PDR Ltd. d/b/a PublicDomainRegistry.com. Its authoritative name servers are 25601122951.earth.orderbox-dns.com, 25601122951.mars.orderbox-dns.com, and 25601122951, and DNS resolution points to the IPv4 address 165.154.202.144. The domain is currently listed on one public blocklist and has been added to the PhishDestroy blocklist, confirming that at least one defensive service has identified it as malicious.

VirusTotal has scanned the domain with 91 security vendors; none have raised a detection, but the absence of a detection does not constitute a safety assurance. No SSL/TLS certificate details, page title, or brand impersonation evidence have been published, leaving the specific luring vector undefined. The lack of visible branding or targeted brand name in the available metadata limits attribution, but the classification as a generic phishing site suggests the site likely hosts credential‑stealing pages or malicious redirects. Defenders should proactively block DNS resolution for www.mandybio.com and its associated IP 165.154.202.144 at perimeter devices, incorporate the domain into URL filtering policies, and monitor network logs for any outbound connections to the host.

Continuous re‑scanning with sandbox and reputation services is advised, as the threat actor may later upload malicious payloads that could trigger detections. Organizations should also review authentication logs for signs of credential reuse and enforce multi‑factor authentication to mitigate potential credential compromise. Given the limited public intelligence, ongoing observation of the domain’s DNS records, any changes to its hosting infrastructure, and subsequent VirusTotal submissions will be essential for timely detection of escalations.