mitramelbet[.]com

Analysis indicates that mitramelbet.com is an active phishing domain targeting users through a gambling affiliate program facade. The domain resolves to 136.144.176.91 (Netherlands, TransIP BV) and presents a page titled 'Program Afiliasi Melbet Indonesia | RevShare hingga 40% untuk Pemilik Audiens,' suggesting a focus on Indonesian-speaking audiences. The site is hosted on nameservers ns3.my-nds.com and ns4.my-nds.com, a pattern observed in other phishing infrastructure. SSL certification is provided by Let's Encrypt (YR2), a common but not inherently malicious provider. As of July 19, 2026, the domain remains active with an HTTP 200 status, confirming operational hosting. It appears on one security blocklist and is flagged by two of 91 vendors on VirusTotal, indicating limited but present detection. Registration details point to NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with fraudulent domains. The domain is explicitly blocked by PhishDestroy, reinforcing its classification as a high-risk threat. Defenders should treat this domain as part of a phishing campaign leveraging gambling affiliate incentives to harvest credentials or financial data. No evidence confirms the legitimacy of the advertised 'RevShare' program, and the domain lacks verified ties to Melbet or authorized partners. Network-level blocking of 136.144.176.91 and the associated nameservers is recommended. Further investigation into the site's backend or user interaction mechanisms is pending, but current indicators justify immediate containment measures.