bonus-wheel[.]icu

This domain, bonus-wheel.icu, is identified as a crypto drainer phishing site designed to deceive users into connecting cryptocurrency wallets under the guise of a token reward or bonus wheel scheme. Analysis of the page title, 'TMA,' suggests potential targeting of Telegram-based audiences or applications, though no direct brand impersonation is confirmed. The infrastructure lacks association with known drainer kits like Angel Drainer or Inferno Drainer, indicating a custom or less prevalent malicious framework. Infrastructure analysis reveals the domain was registered on May 4, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently exploited for malicious registrations. It resolves to the IP address 188.114.97.3, which is part of a network range historically linked to phishing and malware distribution. At the time of assessment, 13 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on three security blocklists and is actively blocked by wallet security tools and browser-based phishing protection systems. Technologies detected include PHP, Cloudflare, and Cloudflare Browser Insights, which are often leveraged to obfuscate malicious activity and evade detection. The domain is currently offline, likely due to takedown efforts or infrastructure rotation by threat actors. Despite its inactive status, residual risk remains for users who may have interacted with the site prior to its removal. Historical DNS records and cached pages may still pose a threat if accessed. Users are advised to revoke any wallet permissions associated with this domain and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. Continuous monitoring of newly registered domains with similar patterns is recommended to mitigate emerging threats.