macelos[.]cyou

Analysis indicates that the domain macelos.cyou was registered on 17 November 2025 through TuringSign Inc. d/b/a Cosmotown. The authoritative nameservers ndns1.cosmotown.com and ndns2.cosmotown.com resolve the domain to the IPv4 address 66.85.46.240, which belongs to AS393960 hosted by Host4Geeks LLC in the United States. The site presented an SSL certificate issued by Let’s Encrypt, valid for the current year (YR2). The only visible page title retrieved before the domain was taken offline was “Energen – Free Bootstrap 4 Template by Colorlib”, suggesting the front‑end used a publicly available Bootstrap template rather than a brand‑specific landing page. Reputation data show that macelos.cyou is currently flagged by 15 of 91 VirusTotal scanners, indicating a moderate consensus among security vendors that the domain is malicious.

It is listed on a single public blocklist and has been actively blocked by the PhishDestroy service. The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of low trustworthiness. The domain’s status is reported as offline at the time of this analysis, which may be the result of takedown actions or the operator’s own shutdown. The combination of a recent registration date, low‑trust hosting, a generic template page title, and multiple vendor detections aligns with the generic phishing classification supplied in the threat feed. However, the specific phishing campaign details—such as targeted brands, credential‑stealing pages, or payloads—are not present in the available intelligence, leaving the exact attack vector uncertain.

Defenders should continue to block macelos.cyou at network perimeter and DNS layers, monitor for any resurgence of the domain or its IP range, and consider adding the associated IP address 66.85.46.240 to internal blocklists.