mailer6-ver[.]mdbgo[.]io

Analysis indicates that the domain mailer6-ver.mdbgo.io is actively serving a credential phishing operation as of July 12, 2026. The domain resolves to 93.105.88.216 (AS50606, Poland) and is hosted on infrastructure managed by OVH SAS, with nameservers dns17.ovh.net and ns17.ovh.net. The site returns an HTTP 200 status and presents a page titled 'Sign In.', consistent with login-credential harvesting. Detected technologies include Node.js, Bootstrap, Nginx, Express, and jsDelivr, suggesting a modern web stack commonly used in phishing campaigns to evade detection and mimic legitimate services. Security vendors have flagged this domain, with 21 of 95 engines on VirusTotal identifying it as malicious. It appears on two security blocklists and is explicitly blocked by PhishDestroy and PhishingDB. The domain was registered on October 19, 2020, and uses a Let's Encrypt SSL certificate (R13), which provides HTTPS encryption but does not validate the site's legitimacy. The Gridinsoft trust score of 0/100 further corroborates its high-risk classification. While the exact brand or service being impersonated is not confirmed in the available data, the page title and scam type indicate a focus on credential theft. Defenders should treat this domain as active and hostile, blocking resolution at the DNS level and monitoring for connections to the associated IP. Given the domain's age and persistent activity, it may be part of a larger, recurring phishing infrastructure. No evidence suggests this is a one-time or short-lived campaign, and organizations should prioritize awareness and technical controls to mitigate exposure.