www-bonkplus[.]top

The domain www-bonkplus.top is identified as a crypto drainer phishing site designed to steal cryptocurrency wallet credentials and drain funds. Analysis confirms this domain is currently offline, though it previously hosted malicious infrastructure targeting users through deceptive wallet connection prompts. No legitimate brand impersonation has been confirmed, but the technical indicators align with known crypto drainer campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through registrar R12, an entity frequently associated with high-risk domains. It resolved to the IP address 144.31.244.50, hosted under AS213877 (U1 DIGITAL SERVICES LTD) in Germany, a network segment with a history of malicious activity. The domain appears on five security blocklists, including PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. VirusTotal detection metrics show 17 of 95 security vendors flagging this domain as malicious, with a focus on crypto-related threats. The SSL certificate, issued by R12, lacks transparency and is consistent with short-lived phishing campaigns. Current status indicates the domain has been taken offline, likely due to enforcement actions or infrastructure takedowns. However, users who interacted with this domain prior to its removal remain at risk of credential theft or financial loss. Recommended actions include revoking any wallet permissions granted to this domain, monitoring transaction histories for unauthorized activity, and implementing browser-based phishing filters. Organizations should update blocklists to include this domain and its associated IP address. Given the high-risk nature of crypto drainer threats, affected users are advised to transfer assets to new wallets if compromise is suspected.