bonkmeme[.]top

Analysis of bonkmeme.top shows a recently registered domain (created 06 Sep 2025) that was hosted behind Cloudflare’s network (IP 172.67.175.166, AS13335, United States). The domain uses Cloudflare name servers (amos.ns.cloudflare.com, dayana.ns.cloudflare.com) and does not present an SSL certificate, indicating it was serving HTTP content only. The only visible artifact is the page title "Just a moment...", which provides no indication of the intended victim brand or credential‑stealing payload.

Reputation services rate the domain extremely low: Gridinsoft assigns a trust score of 0 / 100, Scamadviser 1 / 100, and two of ninety‑five VirusTotal scanners flagged the site, confirming malicious intent. The registrar listed is PDR Ltd. d/b/a PublicDomainRegistry.com, a provider often associated with disposable or abusive registrations. The infrastructure is listed on a single blocklist and has been actively blocked by the PhishDestroy feed, reflecting that threat‑intelligence communities have observed malicious activity linked to this host.

Current status is offline, suggesting the operators have taken the site down, possibly after detection or as part of a rotation. Defenders should continue to block the domain and its associated IP address at network borders, update URL filtering and DNS sinkhole policies, and monitor for any re‑use of the same Cloudflare‑assigned IP range in future campaigns. Given the low trust scores, lack of TLS, and early detection by multiple vendors, the domain should be treated as a high‑confidence phishing indicator despite its temporary offline state.