melltnnhk-wollet[.]gitbook[.]io

Analysis of melltnnhk-wollet.gitbook.io as of August 1, 2026 confirms its classification as an active phishing domain targeting cryptocurrency wallet users. The domain, registered on March 30, 2014, is hosted on Cloudflare infrastructure with nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com, resolving to IP address 172.64.147.209. While the registration date predates typical phishing campaigns, this is not uncommon for compromised or repurposed domains. The domain appears on two security blocklists and is actively blocked by PhishDestroy and OpenPhish, indicating confirmed malicious activity.

VirusTotal reports 14 of 91 security vendors flagging this domain, providing additional technical confirmation of its phishing status. The specific threat appears to involve cryptocurrency wallet credentials, as suggested by the 'wollet' component in the domain name, though the exact content and targeting mechanism remain unconfirmed without direct page analysis. The GitBook.io subdomain suggests the use of legitimate documentation hosting services for malicious purposes, a common tactic to evade detection. Defenders should treat this domain as high-risk.

Recommended actions include immediate blocking at network and endpoint levels, monitoring for connections to 172.64.147.209, and reviewing logs for any interactions with the domain. Given Cloudflare's hosting, IP-based blocking may affect legitimate services, so domain-based blocking is preferred. Security teams should investigate potential credential exposure if any users accessed the site and consider proactive password resets for cryptocurrency-related accounts as a precautionary measure. The domain remains active as of this report, requiring ongoing monitoring for infrastructure changes or new detection patterns.