sgin9-alibaba[.]mdbgo[.]io

This domain, sgin9-alibaba.mdbgo.io, poses a direct threat as a brand impersonation site designed to mimic Alibaba’s legitimate manufacturer and supplier directory. The site’s primary objective is to deceive users into entering sensitive credentials, such as corporate login details or financial information, by presenting a near-identical interface to Alibaba’s official platform. Given the elevated risk level and the domain’s historical activity, it is highly likely that any data submitted would be harvested for fraudulent purposes, including unauthorized account access, financial theft, or further phishing campaigns targeting business partners or customers. The use of a well-known brand like Alibaba increases the likelihood of successful deception, particularly among users unfamiliar with the nuances of legitimate domain structures or SSL certificate issuers.

Analysis indicates that sgin9-alibaba.mdbgo.io was registered on October 19, 2020, through OVH SAS, a registrar commonly associated with both legitimate and malicious domains. The domain resolves to the IP address 93.105.88.216, located in Poland under AS50606 (Horyzont Technologie Internetowe sp.z.o.o.), an autonomous system that has previously hosted other suspicious domains. The SSL certificate, issued by Let’s Encrypt (R13), is valid but does not mitigate the risk, as malicious actors frequently leverage free certificates to lend a false sense of legitimacy. VirusTotal detection rates confirm the domain’s malicious nature, with 20 out of 95 security vendors flagging it as a threat. Additionally, the domain appears on two security blocklists, PhishDestroy and PhishingDB, further corroborating its classification as a brand impersonation site. The page title, "Alibaba Manufacturer Directory - Suppliers, Manufacturers, Exporters & Importers," is a direct copy of Alibaba’s official branding, reinforcing the site’s deceptive intent.

Users who have visited sgin9-alibaba.mdbgo.io or interacted with its content should take immediate action to mitigate potential risks. First, disconnect the affected device from the network to prevent any ongoing data exfiltration. Next, reset all credentials that may have been entered on the site, prioritizing corporate accounts, email logins, and financial platforms. Enable multi-factor authentication (MFA) on all critical accounts to add an additional layer of security. Monitor accounts for unauthorized transactions or suspicious activity, and report any anomalies to the relevant security teams or financial institutions. If the device used to access the site is part of a corporate network, notify the internal security team to conduct a forensic analysis. Finally, block the domain and its associated IP (93.105.88.216) at the network level to prevent future access. Given the domain’s current offline status, users should remain vigilant for similar impersonation attempts, particularly those using slight variations of legitimate domain names or branding.