bonkfund[.]xyz

This domain, bonkfund.xyz, is identified as a cryptocurrency-focused phishing resource designed to harvest user credentials and private wallet keys. Analysis indicates no direct association with known brand impersonation templates, suggesting a generic or custom-built drainer kit targeting decentralized finance (DeFi) users. The infrastructure appears tailored to exploit interest in emerging cryptocurrency projects, particularly those leveraging meme-coin branding or airdrop scams, though no specific campaign branding was confirmed in initial triage. Technical indicators reveal the domain was registered on March 28, 2026, through HOSTINGER operations, UAB, a registrar frequently observed in low-sophistication phishing operations. The domain resolves to the IP address 216.198.79.1, a hosting endpoint with no prior reputation for legitimate services. Detection metrics show 4 out of 95 security vendors flagging bonkfund.xyz as malicious, while the domain appears on a single security blocklist. Gridinsoft’s trust scoring system assigned a 0/100 rating, and AlienVault OTX recorded its presence in one threat intelligence pulse, indicating limited but confirmed malicious activity. No entries were found in Google Safe Browsing (GSB) at the time of analysis, suggesting either recent deployment or evasion of broader detection mechanisms. Current status indicates the domain has been taken offline, likely in response to detection by PhishDestroy or similar automated takedown mechanisms. Despite its offline state, residual risk persists due to the potential for infrastructure reuse or migration to newly registered domains. Historical resolution data and registrar patterns suggest the operators may attempt to redeploy the phishing kit under a different domain, particularly if the original campaign yielded successful credential harvesting. Users who interacted with the domain prior to takedown are advised to revoke wallet permissions, rotate credentials, and monitor for unauthorized transactions. Organizations are recommended to preemptively block the IP 216.198.79.1 and monitor for domains registered through the same registrar with similar naming conventions.