mecas[.]one

PhishDestroy identifies elevated risk associated with the domain mecas.one, reflecting active phishing operations designed to deceive users via counterfeit account authentication pages. The campaign leverages time-sensitive urgency and branded impersonation to trick victims into surrendering sensitive credentials or payment details. Analysis confirms the infrastructure is operational and evolving, warranting immediate defensive action.

This domain was flagged at 1 detection out of 95 participating security vendors on VirusTotal, correlating with minimal—but not absent—early-stage detection coverage. The domain was registered on March 1, 2026 through Gname.com Pte. Ltd., a registrar known for rapid bulk registrations. Resolution maps to IP address 104.21.42.212 via Cloudflare, which hosts the malicious endpoint behind an active Let’s Encrypt SSL certificate (indicating HTTPS presentation). Despite low vendor detection, there is no evidence the domain appears on major blocklists to date, suggesting it remains in a window of relative obscurity for threat actors.

Given the active phishing threat, users and organizations should immediately block inbound DNS resolutions for mecas.one and inspect outbound traffic for connections to 104.21.42.212. Validate all URLs through corporate threat intelligence platforms or browser safety extensions prior to authentication attempts. Security teams should monitor IDS/IPS logs for HTTP(S) requests targeting this domain and update browser policies to flag or block the URL. Proactive takedown requests should be submitted to hosting providers and registrars using the aggregated IOCs. Due to the fresh registration and low initial detection rate, this domain remains a high-priority candidate for preventative controls and ongoing monitoring.