secure-mercu-chat[.]ovh

On 24 July 2026 the domain secure-mercu-chat.ovh was observed as an offline credential‑phishing infrastructure. The domain was registered through OVH on 6 March 2026 and is delegated to the OVH‑provided nameservers dns14.ovh.net and ns14.ovh.net. DNS resolution returns the IPv4 address 213.186.33.5, which belongs to AS16276 OVH SAS and is geolocated in France. An active TLS certificate issued by Let’s Encrypt (certificate identifier E8) covers the host, indicating that HTTPS was available at the time of observation.

The HTTP response contained the page title “Site en construction”, but no further content was captured before the site was taken offline. VirusTotal scans recorded three positive detections out of ninety‑four submitted security engines, and the domain is listed on three public blocklists that include PhishDestroy, MetaMask and SEAL. The combination of recent registration, OVH‑controlled hosting, a valid TLS certificate, and multiple vendor detections aligns with typical credential‑phishing campaigns that exploit newly registered domains to host login‑capture pages before rapid takedown.

Because the site is currently offline, active mitigation is limited to pre‑emptive defenses: network firewalls and web‑filtering solutions should block the IP address 213.186.33.5 and the domain name, and security teams should monitor for any resurgence of the domain or related subdomains. Continuous observation of the OVH name‑server zone for re‑registration and of the associated ASN for similar patterns is recommended. Until the domain reappears, no additional malicious payloads or phishing page structures have been confirmed, and the primary evidence remains the registrar data, hosting footprint, TLS presence, vendor detections, and blocklist listings.