eligible-bonkcoin[.]top

Analysis of eligible-bonkcoin.top indicates a high-risk phishing domain targeting cryptocurrency users, currently active as of July 25, 2026. The domain was registered on December 29, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with fraudulent domains. Infrastructure analysis reveals Cloudflare hosting (AS13335, US), with nameservers aldo.ns.cloudflare.com and paityn.ns.cloudflare.com, and an IPv6 address of 2a06:98c1:3120::3. The site employs Cloudflare Browser Insights and HTTP/3, common among phishing pages for performance and evasion. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which does not mitigate the domain's malicious intent.

The domain is flagged by one security blocklist (PhishDestroy) and appears in one AlienVault OTX threat intelligence pulse, confirming its classification as malicious. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk status. The HTTP status returns a 403 Forbidden error, which may indicate a Cloudflare firewall rule or a temporary block, though the domain remains operational. The page title 'Un instant…' suggests a loading or redirect page, but the exact content and target (e.g., wallet credentials, seed phrases) are not yet analyzed.

Four of 93 security vendors on VirusTotal flag eligible-bonkcoin.top as malicious, though the absence of detections from other vendors does not imply safety. Defenders should treat this domain as active infrastructure for cryptocurrency phishing. Recommended actions include blocking the domain at DNS and firewall levels, monitoring for related subdomains or IPs, and alerting users to avoid interaction. Further investigation into the domain's backend or associated campaigns may reveal additional indicators of compromise.