mellbonus[.]cc

The domain mellbonus.cc has been identified as a generic phishing threat, specifically functioning as a crypto drainer designed to steal cryptocurrency wallet credentials and digital assets. This domain is currently offline, having been taken down after its malicious activity was detected and reported by security researchers. While no specific brand was impersonated, the domain's structure and behavior are consistent with common crypto-themed phishing lures that trick users into connecting their wallets or entering private keys.

Technical analysis reveals that mellbonus.cc was created on April 04, 2026, and registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It was hosted on the IP address 172.67.148.201 and secured with a Let's Encrypt SSL certificate (E7). VirusTotal flagged this domain as malicious by 7 out of 95 security vendors, indicating moderate but clear risk. Additionally, it appeared on 1 security blocklist and had trust scores reflecting its phishing nature. The domain's registration with a less reputable registrar and its recent creation date are common indicators of disposable phishing infrastructure.

Given the domain is now offline, the immediate threat is mitigated, but users should remain vigilant. PhishDestroy recommends that anyone who may have interacted with mellbonus.cc—especially by connecting a cryptocurrency wallet or entering sensitive information—should immediately transfer funds to a new wallet and revoke any permissions granted. Always verify domain legitimacy through official channels and use PhishDestroy's tools to check for similar threats. The takedown demonstrates effective collaboration between security platforms, but the phishing kit may be reused under different domains; ongoing monitoring is advised.