In our investigation into ZephyrScama1, we noted that some phishing sites using this kit were hosted by a “bulletproof” server rental service called MezoHost, used to support phishing campaigns and linked to a French-speaking cybercriminal sphere. In this article, we aim to better understand how MezoHost operates and how it has evolved.
MezoHost, a bulletproof hosting provider that doesn’t hide
MezoHost runs a website on the clear web that offers two services: (i) dedicated and virtual server rental, and (ii) domain name registration. The site openly presents the service as anonymous and “bulletproof,” which signals that it targets customers with criminal or fraudulent intent. Its specialty appears to be a web hosting platform configured to facilitate fraud, managed through a professional, legitimate, commercial control panel: Plesk.
It is also worth noting that the service appears to have originated in the French-speaking sphere. The website, which appeared in June 2025, did not come out of nowhere: MezoHost had previously been operating, with somewhat lower visibility, through Telegram channels since at least February 2023. Several Telegram channels were created, the oldest being @rdsportail, operated by French-speaking threat actors created in February 2023. The group’s title, “The Scammer’s Kingdom”, clearly indicates its aim as offering place to discuss fraudulent operations:
It was on these somewhat more discreet and informal channels that MezoHost’s operators apparently began their operation. They initially sold phishing services and technical training on how to use them2, and soon afterwards added Plesk server rental and domain name registration. From July 2024, this offering was branded “MezoPlesk.”
For the rest of our investigation, a few noteworthy details emerge from this channel:
1. One of the main operators announced that he was stepping down in January 2025, and a new Telegram channel, @portalrds, was created in February 2025. After that date, it seems that only one operator is left, and we no longer observe phishing kit sales on the channel, only the sale of hosting infrastructure and the promotion of the MezoHost “brand.”
2. The organizers of this channel include the following account: @mezo6969 (aka @mezov2), regarded as the “technical lead”.
The move from the Telegram channel to the MezoHost website took place a few months later in June 2025. It was driven by the goal of replacing a manual service with an automated one. Customers can now subscribe directly to hosting and domain registration services, whereas these previously required exchanges on Telegram and the involvement of one of the organizers, which made 24/7 service impossible.
Mapping a shifting infrastructure
While, on one side of the web, a service offering was emerging under the MezoPlesk and MezoHost names, on the other, the first servers configured with an SSL certificate for the domain mezoplesk[.]cc appeared almost simultaneously. A brand was being born… along with the signals that would make it easier to track this hosting provider.
To identify the recent infrastructure used by MezoHost, we started from a phishing domain identified during the ZephyrScama investigation: myaccounts-portal[.]com. This domain resolved to the IP address 45.74.61[.]7. The HTML code returned by the server at this IP revealed a Plesk instance displaying the “MezoPlesk” identity, both as an image and in the page’s HTML title.
The MezoPlesk image on the Plesk login page (Figure 5) is identical to the one hosted on the MezoHost website (see Fig. 1), indicating that this is not a mere coincidence of names.
Furthermore, this server presented an SSL certificate for the FQDN “pleskv2.mezohost[.]info” on ports 21 and 8443, confirming that it is indeed a server belonging to the MezoHost hosting provider.
.png)
Source: ONYPHE
Indeed, the MezoHost website acknowledges the following domains as its “official” domains, which all resolve to the same IP address:
- mezohost[.]info
- mezohost[.]net
To characterize MezoHost’s modus operandi and infrastructure, we used the ONYPHE platform to track servers rented by MezoHost over a 130-day period, searching for the following fingerprints:
- HTML title containing the string “MezoPlesk”
- PPlesk page customized for “Mezoplesk”
- SSL certificate for mezohost[.]info, then mezohost[.]net
- Favicon
We also used VirusTotal to search for the older IP addresses that used mezohost[.]cc (the mezoplesk[.]cc was too old)
This allowed us to uncover a set of IP addresses, which we divided into three main groups based on their SSL certificates (see Table 1). By analyzing their lifespans3, we can then easily reconstruct how the infrastructure evolved over time.
MezoHost initially used servers connected to the Internet through OmegaTech LTD and associated them with the domain mezohost[.]cc. From February 2026, the servers were rented from the hosting provider 69HOST LLC, which announced IP address blocks allocated first to Rapidseedbox Ltd, then, in parallel, to MICFO-CA. These servers were configured with a new SSL certificate for pleskv2.mezohost[.]info. Since August 2026, MezoHost’s servers have been configured with SSL certificates for subdomains of another domain, mezohost[.]net. With each change of IP pool and SSL certificate, the overlap between IP addresses lasts only a few days, after which all IP addresses and SSL certificates are abandoned and replaced by the new group
Table 1. MezoHost’s shifting infrastructure over time. (Source : OWN)
Historical passive DNS data for these IP addresses shows that, while MezoHost was using them, several hundred domains resolved them. The names of these domains clearly pointed to attempts to steal accounts, identities or banking data by impersonating familiar services: social security, energy bills, film and music streaming platforms, postal services, and so on. Online reports of fraud attempts in France, Belgium and the Netherlands involving domains on MezoHost infrastructure are numerous. In other words, none of these servers hosted a legitimate website.
We also note that MezoHost operates only about half a dozen Internet-facing servers at any given time, over periods of several months, which should make it an easy hosting provider to block.
Domain Registration through MezoHost
MezoHost also offers a domain registration service through its website. Our data suggests that 69HOST is the component responsible for DNS management for these domains.
Indeed, we observed that a significant share of the domains resolving to MezoHost servers used name servers administered by 69HOST (ns1.69host[.]cc, ns2.69host[.]cc), as shown in the example below:
Source: OWN, VirusTotal, DomainTools
Conversely, we analyzed the DNS resolutions of 808 domains using the same two 69HOST Name Servers (out of 2,400 domains in the DomainTools database). The same correlation holds in the other direction: at least two thirds of these domains resolved to an IP address used by MezoHost. Moreover, all of domains registered before August 29, 2026 listed Global Domain Group LLC as their registrar, an anonymous domain registration service for which 69HOST is listed as a reseller (see Figure 9) 4.
These facts point to a strong correlation between 69HOST and MezoHost. Four additional factors support a strong link between the two entities:
1. The first factor is temporal: the domain 69host[.]cc was registered fifteen days before mezohost[.]cc and mezohost[.]net, and the first domain whose name servers were managed by 69HOST was registered two days after the MezoHost website appeared.
2. The second factor is quantitative: at the time of writing, 60% of the active IP addresses in the 45.74.61.0/24 range announced by 69HOST are used by MezoHost.
3. The third factor is a June 2025 resolution of mezohost[.]info to the same dedicated server as ns2.69host[.]cc (see Figure 10).
4. Finally, the last factor is simply the use of the ‘69’ number in the pseudonym @mezo6969 to sell MezoHost services before switching to @mezov2 (see Figure 11)
Our hypothesis is that, following the departure of one of its members, MezoHost’s remaining operator(s) focused on running and developing the hosting service, aiming to make it self-sufficient through automation. To that end, they may have taken over or imitated the methods and relationships of the bulletproof hosting providers they were already using, such as OmegaTech, considered to be a reseller or front for the Russian bulletproof hosting provider VIRTUALINE5. OmegaTech and 69HOST do share several features:
- Internet connectivity through AS30823, owned by aurologic GmbH, an organization already known for providing network connectivity to several other cybercriminal networks6 (see Figure 12).
- Presence in the routing policies declared by AS51396 (PfCloud), which is also suspected of supplying other bulletproof hosting providers with autonomous systems and connectivity5 and 7 (see Figure 13).
Conclusion
MezoHost is a phishing fraud facilitator whose clientele primarily targets France (including its overseas territories), Belgium and the Netherlands, and which can easily be identified and blocked at the network layer.
Tracking MezoHost’s infrastructure through the ONYPHE, VirusTotal and DomainTools platforms allowed us to correlate changes within this infrastructure with the various announcements and developments of the MezoHost service, notably its automation.
Our investigation points to a strong link between the MezoHost service and the company 69HOST LLC, leading us to suspect that the latter was created by MezoHost’s operators. The integration of MezoHost and 69HOST into a well-documented bulletproof hosting ecosystem, with well-honed methods for regularly obtaining new IP address ranges, demonstrates once again how readily this cybercriminal economy’s know-how is passed on.
Footnotes
1. https://www.own.security/ressources/blog/zephyrscama
2. Along with the occasional sale of cannabis
3. The lifespan of these groups was assessed by using VirusTotal’s SSL certificate historical data for each IP address.
4. after that date, domains became registered through the registrar NICENIC.
6. https://www.recordedfuture.com/research/malicious-infrastructure-finds-stability-with-aurologic-gmbh
