mag-lana[.]mssg[.]me

The domain mag-lana.mssg.me has been identified as a credential phishing site. The page title displayed in the browser reads “🔮 Ясновидящая Лана”, indicating a possible focus on Russian‑language users. The site delivers a deceptive login interface designed to harvest user credentials, matching the generic_phishing classification. The domain was created on 24 January 2017 and resolves to the IP address 104.26.13.20, which belongs to a large content‑delivery network operating out of Canada. The site serves traffic over HTTPS using a free TLS certificate issued by a widely used certificate authority. HTTP responses include HSTS, confirming the use of strict transport security. Network analysis shows the presence of multiple analytics and tracking scripts, including generic web‑analytics, tag management, and social‑media tracking pixels. These components are typical of phishing kits that monitor visitor behavior and attempt to evade detection. The domain is listed on a known phishing blocklist and has a trust score of zero from a security rating service. Public DNS information is limited; the nameserver records could not be retrieved, and no additional subdomains have been observed. Virus scanning services have not flagged the site, but the absence of detections does not imply safety given the confirmed phishing behavior. The underlying infrastructure appears to rely on a shared CDN, making attribution to a specific operator difficult. Defenders should add mag-lana.mssg.me to URL filtering and email gateway blocklists, monitor for any outbound connections to the associated IP, and enforce credential‑reuse detection to limit account compromise. Continuous re‑inspection of the IP and certificate revocation status is advised, as the phishing infrastructure may shift to adjacent addresses.