eligibility[.]bonksolana[.]xyz

eligibility.bonksolana.xyz was observed as a malicious domain targeting the Solana brand. The domain was registered on September 09, 2025 through NiceNIC International Group Co., Limited and resolves to the Cloudflare edge address 104.21.31.117, which belongs to ASN 13335 (Cloudflare, Inc.) located in the United States. No SSL certificate is presented for the host, and the HTTP response currently returns a generic page with the title “Just a moment…”. The site has been classified as a crypto‑scam and is listed by PhishDestroy as blocked. VirusTotal analysis shows that two of ninety‑five scanned engines flagged the domain, indicating a low but non‑zero detection rate.

Independent reputation services assign extremely low trust scores: Gridinsoft rates it 0/100, while Scamadviser reports a 1/100 rating. The domain appears on a single security blocklist, reinforcing the indication of malicious activity. Nameservers are michael.ns.cloudflare.com and robin.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The available evidence confirms the domain’s intent to impersonate Solana, yet the exact payload and user‑facing content remain unverified because the site is currently offline. No TLS certificate, no visible login page, and only the placeholder title have been captured.

Consequently, analysts cannot determine whether the site hosted phishing forms, malicious binaries, or redirect chains. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host, and add the IP address 104.21.31.117 to threat intel feeds. Periodic rescans with VirusTotal or similar services are advised to capture any changes in detection status. Updating endpoint and web‑gateway filters with the observed indicators of compromise will mitigate exposure to this low‑trust, brand‑impersonation campaign.