bonk[.]marketing

The domain bonk.marketing is currently listed as offline but retains multiple indicators of a confirmed banking phishing operation. Analysis of passive DNS shows the domain resolves to 188.114.96.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The authoritative nameservers are aaden.ns.cloudflare.com and nataly.ns.cloudflare.com, confirming that the registration was performed through Cloudflare’s registrar service. HTTPS is presented with a certificate issued by Google Trust Services under the WE1 profile, and the site advertises Cloudflare Browser Insights and HTTP/3 support, suggesting use of Cloudflare’s performance stack.

Reputation services corroborate malicious intent: Scamadviser assigns a trust score of 1 / 100, and VirusTotal records 13 of 95 scanning engines flagging the domain as malicious. The domain appears on two public blocklists and is explicitly blocked by PhishDestroy and ScamSniffer. AlienVault OTX references the domain in a single threat‑intel pulse, further linking it to known phishing activity. The only visible page title returned by the server is “404 Not Found,” indicating that the landing page has been removed or is otherwise inaccessible.

While the offline status limits real‑time observation of payloads, the accumulated evidence—registration through Cloudflare, low trust score, multiple vendor detections, blocklist listings, and the designation as a banking phishing site—supports a high confidence assessment of malicious intent. Defenders should continue to block the domain at perimeter devices, add the IP address 188.114.96.3 to deny‑list rules where appropriate, and monitor for any resurgence of the host. Threat‑intel teams are advised to reference the OTX pulse and incorporate the domain’s identifiers into phishing‑detection signatures to improve detection of future campaigns that may reuse the same infrastructure.