eligible-bonk[.]ltd

Analysis of the infrastructure associated with eligible-bonk.ltd shows a recently created domain (registered on December 12, 2025) that is actively hosting a generic phishing campaign. The domain resolves to the IP address 172.67.202.22, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. Cloudflare services are evident from the presence of HSTS, HTTP/3 support, and the authoritative nameservers pola.ns.cloudflare.com and vasilii.ns.cloudflare.com. The site presents a TLS certificate issued by Google Trust Services under the WE1 entity, indicating that encrypted connections are being offered despite the malicious intent. An HTTP request returns a 403 status code, suggesting that the server is configured to deny unauthorized access or that automated scanners are being blocked.

The only visible page element is the title "Nur einen Moment…", and no further content has been publicly disclosed. Reputation scoring from Gridinsoft is 0 out of 100, reflecting an extremely low trust rating. VirusTotal analysis shows that 2 of 95 security vendors have flagged the domain, and it is listed on at least one external blocklist. PhishDestroy has also added the domain to its blocklist, confirming its use in phishing operations.

The registrar information lists PDR Ltd. d/b/a PublicDomainRegistry.com as the sponsoring registrar. While the exact phishing lure, credential collection method, or targeted brand remains unknown, the combination of a new domain, low trust score, Cloudflare front‑end, and existing blocklist entries indicates a high‑risk threat. Defenders should immediately block DNS resolution for eligible-bonk.ltd, enforce outbound filtering for the associated IP address, and incorporate the domain into intrusion detection signatures. Continuous monitoring of Cloudflare‑hosted IP ranges for similar patterns, along with periodic re‑scanning of the URL, is recommended to capture any evolution of the payload or changes in the hosting configuration.