newyear-bonk[.]fun

Analysis of the domain newyear-bonk.fun indicates it was registered on December 21, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing and abuse reports. The domain resolves to the IP address 104.21.63.152, which is part of AS13335, operated by Cloudflare, Inc. in the United States. Cloudflare’s infrastructure is commonly utilized by threat actors to obfuscate the true origin of malicious domains, and this domain’s use of Cloudflare nameservers (annalise.ns.cloudflare.com and chris.ns.cloudflare.com) aligns with this pattern. At the time of assessment, the domain was offline, returning no active HTTP response or SSL certificate. The page title 'Just a moment...' is consistent with Cloudflare’s default interstitial page, suggesting the domain may have been recently deactivated or was never fully operational.

Despite its offline status, the domain appears on at least one security blocklist, specifically PhishDestroy, and is flagged by 2 of 93 security vendors on VirusTotal, though the specific detection logic remains unverified. Gridinsoft assigns a trust score of 0/100, further indicating high-risk classification. The domain name itself, 'newyear-bonk.fun,' suggests a potential association with cryptocurrency-themed phishing, particularly given the inclusion of 'bonk,' a term linked to the BONK token, a Solana-based memecoin. While no direct evidence of a specific brand impersonation is present in the available data, the naming convention and timing of registration (December 2025) align with seasonal phishing campaigns targeting crypto communities during holiday periods.

Defenders should treat this domain as part of a broader pattern of opportunistic phishing infrastructure, particularly in the cryptocurrency sector. Given the domain’s registration through a high-abuse registrar, use of Cloudflare hosting, and presence on security blocklists, network defenders are advised to proactively block resolution to 104.21.