mell9197[.]live

PhishDestroy identifies mell9197.live as an active credential theft domain under investigation, currently impersonating a login portal to harvest user credentials. The domain resolves to IP 186.2.175.89 and leverages a Let's Encrypt SSL certificate to appear legitimate. While VirusTotal currently shows 2/95 detections, the absence of flags does not guarantee safety, as threat actors frequently adapt tactics to evade detection. The domain’s recent creation and lack of established reputation pose significant risks to unsuspecting users.

This domain was flagged with a risk level of under_investigation due to its association with generic phishing tactics targeting credential theft. Technical indicators include resolution to IP 186.2.175.89, a Let's Encrypt SSL certificate (validity period not specified), and 2/95 detections on VirusTotal as of the latest scan. The domain’s infrastructure lacks historical data, suggesting it may be newly deployed or repurposed for malicious intent. No blocklist entries or trust scores are publicly available, further underscoring the need for caution.

To mitigate risks associated with credential theft, users should avoid entering sensitive information on this domain. Organizations are advised to implement DNS filtering to block access to mell9197.live and monitor network traffic for connections to the associated IP 186.2.175.89. Additionally, users should enable multi-factor authentication (MFA) on all accounts and verify website URLs before submitting credentials. Security teams should prioritize investigating this domain for potential lateral movement or data exfiltration risks.