mellonecas[.]com

PhishDestroy identifies mellonecas.com as a recently activated crypto drainer domain designed to illicitly harvest cryptocurrency from unsuspecting users. The domain is not impersonating a specific brand but operates as a standalone fraudulent site with a primary objective to trick users into connecting crypto wallets and draining assets. The infrastructure and timing suggest the threat actor may be testing deployment phases before scaling operations or pivoting to brand impersonation tactics. This domain was flagged by PhishDestroy with an under-investigation risk level. Technical indicators include a VirusTotal detection score of 7/95, registration through Fewmoretaps OU d/b/a Trustname.com, resolution to IP address 188.114.97.3, and a domain creation date of March 31, 2026. Google Safe Browsing (GSB) has not yet flagged this domain, and no public blocklist entries were detected at time of analysis. The SSL certificate is issued by Let's Encrypt, which does not indicate legitimacy or fraudulent intent solely on its own. The domain remains active and under active monitoring by PhishDestroy. No public takedown or blocklist inclusion has been recorded. The current risk is assessed as under investigation due to low detection rates despite suspicious behavior patterns. Users are strongly advised to avoid interacting with mellonecas.com and to verify any similar domains using PhishDestroy's real-time safety tool. Until the investigation concludes, caution is warranted for any wallet connection prompts originating from this domain or associated infrastructure.