melania[.]rocks

Analysis on 20 July 2026 shows that melania.rocks is an active generic phishing infrastructure. The domain is registered through GoDaddy.com, LLC and uses GoDaddy’s Secure Certificate Authority (G2) for its TLS certificate, indicating a legitimate‑looking HTTPS endpoint. Authoritative name servers ns37.domaincontrol.com and ns38.domaincontrol.com resolve the domain to the IP address 15.197.148.33, which belongs to Amazon Web Services Global Accelerator and is geolocated in Canada. An HTTP request to the host returns status code 200, confirming that a web service is presently reachable. The site has been flagged by three independent blocklists and is currently blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show two of ninety‑one security vendors flag the domain, and the domain appears on three additional blocklists, reinforcing the suspicion of malicious use. No public page title, brand target, or malware kit information is available, so the exact content being delivered remains unknown. Defenders should block traffic to melania.rocks at network perimeter, add the domain to DNS sinkhole lists, and monitor for related AWS Global Accelerator IP activity. Continuous re‑evaluation is advised as further intelligence, such as payload samples or phishing page screenshots, may emerge.