eligibility-bnbchain[.]com

Eligibility-bnbchain.com was observed hosting a page titled “KMSPico Tool | All‑in‑One Windows & Office Activator 2025”. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolved to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. DNS resolution used Cloudflare authoritative nameservers dalary.ns.cloudflare.com and wilson.ns.cloudflare.com. No TLS certificate was presented when the site was queried, indicating the service was delivered over plain HTTP.

The site was listed on a single public blocklist and was also flagged by PhishDestroy as offline. VirusTotal analysis returned five positive detections out of ninety‑three scanners, confirming that at least a subset of security products consider the domain malicious. The landing page is associated with an “Airdrop Scam” kit and is classified as a crypto‑related scam. Because the site is currently taken offline, active probing is limited, and the exact content of the page beyond the title remains unverified.

Nevertheless, the combination of recent registration, use of reputable Cloudflare infrastructure, lack of TLS, and multiple vendor detections suggests a deliberate attempt to lure victims with a counterfeit software offering. Defenders should continue to monitor the IP address 188.114.96.3 for any re‑use, enforce blocklisting of the domain in network controls, and consider adding the associated nameservers to watchlists. Threat‑intel feeds should be updated to reflect the observed indicators of compromise, including the registrar, creation date, and the five VirusTotal detections. Organizations that employ endpoint or web‑gateway solutions should ensure those solutions are configured to flag any attempt to resolve eligibility-bnbchain.com or to connect to the identified IP, especially for users handling cryptocurrency assets.