melo[.]gg

This domain, melo.gg, is currently active and has been classified as a brand‑impersonation campaign targeting the Roblox brand. The site presents the page title “Melo Interactive 🕹”, indicating a gaming‑related theme, and its content is linked to a Roblox‑focused scam. The threat is recorded under the unique seed 34b6c2 and is listed as under investigation. Infrastructure analysis shows the domain resolves to the IPv4 address 31.43.160.6, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated in the Netherlands. The site is hosted on a Vercel platform and enforces HTTP Strict Transport Security. TLS is provided by a Let’s Encrypt certificate (R13). DNS records are served by ns33.domaincontrol.com and ns34.domaincontrol.com, and the domain was registered through the 1API registrar. An MX record points to melo-gg.mail.protection.outlook.com, suggesting use of a standard email protection service. Threat intelligence sources report a single AlienVault OTX pulse referencing this domain, and it appears on one security blocklist. PhishDestroy has also flagged the domain, confirming its malicious nature. VirusTotal currently shows zero detections out of ninety‑five scans, which does not imply safety and should be interpreted as a lack of prior analysis rather than an absence of risk. Given the active status, the presence of brand‑impersonation indicators, and the confirmed blocklist entries, defenders should treat melo.gg as a malicious indicator. Recommended actions include adding the domain and its resolving IP address to blocklists at network perimeter devices, monitoring DNS queries for the domain and its nameservers, and inspecting outbound traffic for HTTP 307 redirects to the site. Continuous monitoring of threat feeds for additional detections is advised, as the current evidence base is limited to infrastructure and classification data.