roaza1-taro[.]mssg[.]me

This domain, roaza1-taro.mssg.me, is flagged as a credential harvesting phishing site targeting users through deceptive login interfaces. The page title 'Roza' suggests an attempt to mimic legitimate services or brands, likely aiming to capture sensitive user credentials such as usernames, passwords, or financial information. The infrastructure appears designed to blend with legitimate traffic while evading initial detection mechanisms. Analysis indicates the domain was registered on January 24, 2017, through Key-Systems GmbH and currently resolves to the IP address 104.26.12.20. Despite its age, the domain has only been flagged on one security blocklist and shows zero detections out of 95 engines on VirusTotal (0/95). The site employs multiple tracking and security technologies, including HSTS, Google Tag Manager, Google Analytics, Facebook Pixel, and Cloudflare, which may be used to monitor victim interactions or obscure malicious activity. The SSL certificate is issued by Let's Encrypt, providing an appearance of legitimacy. Users who have visited roaza1-taro.mssg.me or entered credentials on this domain should immediately reset passwords for any accounts accessed from the same device or network. Monitor financial transactions and account activity for unauthorized access. Clear browser cache, cookies, and active sessions to mitigate potential session hijacking risks. If corporate or sensitive credentials were exposed, report the incident to internal security teams for further investigation and containment. Avoid interacting with the domain or any associated links.