eligible-sullend[.]fun

Analysis of the domain eligible-sullend.fun confirms its classification as a fraudulent phishing site targeting Discord users through a fake airdrop scheme. The domain was registered on February 27, 2026, via PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the domain resolves to IP address 172.67.199.112, hosted on Cloudflare's network (AS13335), and utilizes Cloudflare nameservers becky.ns.cloudflare.com and keenan.ns.cloudflare.com. The site's page title, 'Phase 2 Distribution,' aligns with known patterns of airdrop scams, where victims are lured into claiming non-existent rewards. Detection data indicates the domain is flagged by three security blocklists, including PhishDestroy, MetaMask, and SEAL, confirming its malicious status.

Gridinsoft assigns a trust score of 0/100, further validating its high-risk nature. While the domain is currently offline, its prior activity and infrastructure remain relevant for defensive measures. Notably, the domain lacks an SSL certificate, a common red flag in phishing campaigns. VirusTotal records a single detection from 93 security vendors, though this limited visibility does not diminish the confirmed threat.

Defenders should prioritize blocking this domain and its associated IP across security gateways. Given the use of Cloudflare, additional scrutiny of domains sharing the same nameservers or IP range may uncover related malicious activity. The absence of SSL and the domain's short lifespan (registered less than five months prior to the report date) are consistent with disposable phishing infrastructure. Organizations are advised to monitor for similar domains registered through PDR Ltd. and leveraging Cloudflare hosting, as these attributes are recurrent in brand impersonation campaigns.