saddem-osbrilcinnworld[.]mdbgo[.]io

Analysis of the domain saddem-osbrilcinnworld.mdbgo.io indicates a confirmed phishing operation targeting Microsoft, specifically impersonating Outlook services. The domain was registered on March 6, 2026, through OVH SAS and is currently offline, returning an HTTP 404 status. Infrastructure analysis reveals it resolved to the IP address 93.105.88.216, hosted in Poland under AS50606 (Horyzont Technologie Internetowe sp.z.o.o.), with nameservers dns17.ovh.net and ns17.ovh.net. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious domains.

Nine of 95 security vendors on VirusTotal flagged this domain as malicious, aligning with its appearance on one security blocklist and its classification as a tech support scam by PhishDestroy, which has blocked access. The page title 'Outlook' directly corresponds to the targeted brand, reinforcing the impersonation of Microsoft's email service. No evidence of additional scam categories (e.g., crypto, shipping, investment) or specific phishing kits is present in the available data. Defenders should treat this domain as a confirmed threat.

The 404 status suggests takedown or abandonment, but historical resolution data and associated infrastructure (IP, nameservers) may still pose risks if reused. Blocking the domain, IP, and nameservers at perimeter controls is recommended. Further investigation into related domains registered through OVH SAS or hosted on 93.105.88.216 may uncover additional malicious activity. The exact content of the phishing page is not yet analyzed, but the combination of brand impersonation, page title, and scam classification provides sufficient evidence for mitigation.