mco[.]greens[.]skin

Analysis of the domain mco.greens.skin shows a recent creation date of February 21, 2026 and registration through Hongkong Kouming International Limited. The authoritative nameservers are ns1.kouming.net and ns2.kouming.net, indicating control by the registrar. DNS resolution points to IP address 140.150.29.58, which is allocated to AS54994 Meteverse Limited and geolocated in the United States. The host presents a Let's Encrypt R13 TLS certificate, a common choice for low‑cost or disposable sites.

HTTP probing reveals that the service is currently taken offline, yet historical scans captured a page title of "en_US" and identified client‑side libraries including ECharts, Envoy, Vue.js, Cloudflare, Google Analytics, and cdnjs, suggesting a typical JavaScript‑heavy front end. Security scoring from Gridinsoft rates the site at 0 / 100, and it appears on a single security blocklist. PhishDestroy has already listed the domain as blocked, and VirusTotal reports one positive detection out of ninety‑three scanners, confirming malicious intent despite the low detection count.

The evidence collectively points to a generic phishing operation, although the exact target or payload is not disclosed. Defenders should immediately add the domain and its IP to blocklists, monitor for any re‑activation, and consider sinkholing the address. Continuous re‑scanning is advised to capture any future changes in content or hosting infrastructure.