melania[.]gold

The domain melania.gold is currently active and classified as a high‑risk generic phishing infrastructure. Registration data shows the domain was created through GoDaddy.com, LLC, and it uses GoDaddy’s default nameservers ns43.domaincontrol.com and ns44.domaincontrol.com. DNS resolution points to IP address 3.33.130.190, which is hosted in the AWS Global Accelerator network and geolocated to Canada. The site presents a valid SSL certificate issued by GoDaddy.com under the GoDaddy TLS Intermediate CA DV - R1v1 chain, indicating the operator has obtained a legitimate TLS certificate to increase credibility. HTTP probing returns a 200 status code, confirming that a web service is actively responding. The domain appears on three security blocklists and has been flagged by PhishDestroy, MetaMask, and SEAL, reinforcing its malicious reputation. VirusTotal analysis shows nine out of ninety‑one security vendors flagged the domain, providing additional independent confirmation of its malicious nature. Given these indicators—active hosting, valid certificate, blocklist entries, and multiple vendor detections—defenders should block melania.gold at network perimeters, update intrusion detection signatures, and monitor for any related indicator activity. Continuous re‑evaluation is advised, as the infrastructure remains active and may be leveraged in future phishing campaigns.