mailer05-tra[.]mdbgo[.]io

Analysis of the domain mailer05-tra.mdbgo.io indicates active phishing infrastructure targeting tradeKorea.com, a platform for verified Korean suppliers. The domain was registered on March 7, 2026, through OVH SAS and currently resolves to the IP address 93.105.88.216. Security vendors have flagged this domain, with 17 out of 95 detecting malicious activity. The page title explicitly matches tradeKorea.com's branding, suggesting an intent to deceive users into believing they are interacting with a legitimate supplier platform. Infrastructure reveals the use of Node.js, Nginx, and Express, technologies commonly employed in both legitimate and malicious web applications. The domain holds a Gridinsoft trust score of 0/100, further supporting its classification as high-risk. It appears on four security blocklists and is actively blocked by PhishingArmy, PhishDestroy, OISD, and BLP-Malware. The SSL certificate is issued by Let's Encrypt, a common choice for both benign and malicious sites due to its accessibility and automation. Defenders should treat this domain as a confirmed phishing threat. The exact content and delivery mechanism remain unanalyzed, but the combination of brand impersonation, low trust scores, and active blocklisting justifies immediate mitigation. Network-level blocking of 93.105.88.216 and mailer05-tra.mdbgo.io is recommended. Further investigation into the hosting provider (OVH SAS) and associated infrastructure may reveal additional linked domains or campaigns.