saddem-marshoutlgroup[.]mdbgo[.]io

The domain saddem-marshoutlgroup.mdbgo.io is a confirmed phishing site engaged in brand impersonation targeting Microsoft. It was designed to mimic Outlook login pages, posing as a legitimate Microsoft service to harvest user credentials under the guise of tech support scams. No crypto drainer kit was detected. The site is currently taken offline, but prior activity classified it as an elevated-risk threat due to its deceptive practices.

Technical indicators confirm the malicious nature of saddem-marshoutlgroup.mdbgo.io. The domain was flagged by 15 of 95 security vendors on VirusTotal, including ADMINUSLabs, CRDF, and Cluster25, and appears on one security blocklist (PhishDestroy). Registered through OVH SAS on March 10, 2026, it resolved to the IP address 93.105.88.216, hosted in Poland under AS50606. The SSL certificate was issued by Let's Encrypt (R13), and the observed page title was 'Outlook'. Technologies detected include Node.js, Bootstrap, Nginx, Express, Cloudflare, and jQuery. Google Safe Browsing did not flag the domain, but Gridinsoft assigned it a trust score of 0/100.

Users who interacted with saddem-marshoutlgroup.mdbgo.io should immediately change their Microsoft account passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Microsoft via their official reporting channels and to platforms like PhishTank or the Anti-Phishing Working Group (APWG) to aid in takedown efforts. If financial or personal data was compromised, consider contacting relevant institutions to secure accounts.