bonkiju[.]xyz

Analysis of www.bonkiju.xyz indicates that the domain is actively serving a page titled "BONKUJI — Airdrop Waitlist". The site is hosted on IP 185.199.109.153, an address owned by GitHub, Inc. in the United States, and is reachable over HTTPS with a valid Let’s Encrypt certificate (YR2). Registration was performed through NameCheap, Inc., using the registrar‑provided nameservers dns1.registrar-servers.com and dns2.registrar-servers.com. HTTP requests return status 200, confirming that content is being delivered. The domain has been listed on a security blocklist and is currently blocked by PhishDestroy. VirusTotal records show that two of ninety‑one scanners flagged the host, reinforcing the suspicion of malicious use. The advertised "Airdrop Waitlist" aligns with the known scam type of a fake airdrop, but the page’s full markup and any credential‑capture mechanisms have not been publicly disclosed, leaving the exact phishing vector uncertain. Defenders should add www.bonkiju.xyz to network and email blocklists, monitor for related C2 traffic to the GitHub IP range, and consider sink‑holing the domain to prevent end‑user interaction. Ongoing observation is recommended to capture any future payload changes.