mesh-field-sphere[.]com

Analysis indicates that mesh-field-sphere.com was registered on February 21, 2026 and subsequently taken offline. The domain resolves to IP address 104.21.84.249, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. The hosting infrastructure is shared with a large content delivery network, reducing the likelihood of direct server compromise but providing anonymity for the operator. The site was flagged by 13 of 95 security vendors on VirusTotal, suggesting that a majority of scanners identified malicious behavior or content.

Both PhishDestroy and ScamSniffer have added the domain to their blocklists, and it appears on two additional public blocklists, reinforcing its classification as a malicious resource. The SSL certificate presented (labelled WE1) is valid for the domain, which is typical for phishing sites that use legitimate TLS termination services to increase user trust. Gridinsoft assigned a trust score of 0 out of 100, indicating an extremely low reputation. No public page title or brand impersonation details are available, and safe browsing or OTX references were not provided, leaving the exact lure or targeted brand undefined.

Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, enforce outbound traffic controls to Cloudflare IP ranges when feasible, and monitor for any residual connections from internal hosts. Incident response teams should also review recent logs for attempts to access mesh-field-sphere.com and consider user education on the risk of unknown credential‑harvesting sites. Ongoing threat‑intel feeds should be consulted for any updates on the domain's activity, as the current evidence points to an elevated risk profile despite its offline status.