medve-law[.]mssg[.]me

PhishDestroy identifies medve-law.mssg.me as an active credential theft domain impersonating the public persona of Mikhail Medvedev, the former Prime Minister of Russia. The site leverages the namesake of a prominent political figure to deceive visitors into submitting sensitive login credentials under the guise of official or professional correspondence. As of the latest assessment, the domain remains live and is actively collecting user data under false pretenses. Credential theft via brand impersonation represents a high-risk tactic frequently deployed to harvest credentials for financial fraud, espionage, or further social engineering campaigns. Users interacting with this domain risk immediate compromise of account credentials and personal information.

This domain was flagged by zero of 95 VirusTotal vendors as of the last scan on the provided seed 73a6f8. It resolves to IP address 172.67.75.137, uses a Cloudflare SSL certificate, and is registered through Key-Systems GmbH. The domain was created on January 24, 2017. It has not been listed on any public blocklists at this time, indicating a stealth implantation likely intended for targeted campaigns rather than large-scale abuse. The combination of a legitimate registrar, long domain age, and clean VirusTotal score suggests sophisticated evasion techniques to bypass automated detection systems.

medve-law.mssg.me is currently active and evaluated as a credible threat under ongoing investigation. Given the demonstrated use of brand impersonation for credential theft and the absence of current blocklist coverage, immediate action is required. Users should avoid accessing or submitting any data to this domain. Security teams are advised to block the domain at the network level, inspect DNS resolution logs for historical contact, and monitor endpoints for signs of credential misuse. Implementing administrative controls to restrict access to the domain via corporate proxies or firewalls is strongly recommended.