mellgam[.]com

Analysis of mellgam.com indicates an active phishing domain registered on February 2, 2026, through NameSilo, LLC. The domain currently resolves to the IP address 194.145.208.194 and utilizes Cloudflare nameservers (eugene.ns.cloudflare.com and faye.ns.cloudflare.com), a common infrastructure choice among threat actors to obscure hosting origins and evade takedowns. As of July 22, 2026, the domain remains operational and is flagged by 12 of 95 security vendors on VirusTotal, suggesting detection by a subset of the security community but not yet widespread coverage. It appears on at least one security blocklist and is actively blocked by PhishDestroy, though the specific brand or service being impersonated has not been confirmed in available data.

The exact content of the phishing page is not yet analyzed, and no page title, phishing kit, or targeted brand is currently documented. Infrastructure analysis reveals the domain’s creation date aligns with recent phishing trends, where newly registered domains are frequently weaponized within weeks. The use of Cloudflare nameservers may complicate attribution, as the service’s proxy capabilities mask the true hosting provider.

Defenders should prioritize monitoring for connections to 194.145.208.194 and mellgam.com in network logs, particularly in environments where credential harvesting or fraudulent transactions are a concern. Given the domain’s persistence and partial detection, organizations are advised to preemptively block access at the DNS or proxy level and review endpoint telemetry for indicators of compromise linked to this infrastructure. Further analysis of the phishing page’s content and payload delivery mechanisms is recommended to determine the full scope of the campaign.