webmailkorea-eee[.]mdbgo[.]io

This report details the technical analysis of the domain webmailkorea-eee.mdbgo.io, a malicious site involved in an email scam operation. The site is designed to impersonate legitimate webmail login portals, specifically targeting users in the Korean email service sector. The primary threat posed by this domain is credential harvesting, where unsuspecting victims are tricked into entering their email account usernames and passwords, which are then stolen by the threat actors.

Technical evidence from the analysis shows the domain was flagged by 13 out of 95 VirusTotal vendors, with detections from Certego, CRDF, CyRadar, ESET, and Emsisoft. The domain is hosted on IP address 93.105.88.216, which is assigned to AS50606 Horyzont Technologie Internetowe sp.z.o.o. in Poland (PL). It was registered through OVH SAS and created on 2026-02-21. The SSL certificate is issued by Let's Encrypt (R13), and the nameservers are dns17.ovh.net and ns17.ovh.net. The domain is currently listed on 2 blocklists.

The current status of the domain is DOWN or OFFLINE, meaning it is not actively serving malicious content at the time of analysis. The overall domain risk score is 73, indicating a high probability of malicious activity. Despite being offline, the domain remains a significant threat due to its recent creation and the potential for it to be reactivated or used in future campaigns.