bonkme[.]xyz

This domain, bonkme.xyz, is identified as a brand impersonation threat specifically targeting users of the Solana blockchain ecosystem. The site presents itself as a legitimate platform related to BONK COIN, a known token within the Solana network, with the explicit intent to deceive users into disclosing sensitive information or transferring cryptocurrency to attacker-controlled wallets. Brand impersonation of this nature is frequently employed in crypto drainer schemes, where victims are tricked into connecting their wallets to malicious smart contracts, resulting in unauthorized fund transfers. The presence of the page title 'BONK COIN' further corroborates the attempt to exploit trust in the Solana brand and its associated tokens.

Analysis of bonkme.xyz reveals multiple technical indicators supporting its malicious classification. The domain was registered on August 17, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar often leveraged by threat actors due to its accessibility and low friction for domain acquisition. VirusTotal detection metrics show that 4 out of 95 security vendors have flagged this domain as malicious, a relatively low but still significant ratio that underscores its suspicious nature. The domain resolves to the IPv6 address 2a06:98c1:3120::3, which has been associated with other malicious infrastructure in recent threat intelligence reports. Additionally, bonkme.xyz appears on one security blocklist, indicating prior identification by automated or manual threat detection systems. The domain has since been taken offline, though its infrastructure may remain dormant for future reuse.

Users who visited bonkme.xyz or interacted with its content are advised to take immediate remediation steps to mitigate potential risks. If any cryptocurrency wallets were connected to the site, users should assume compromise and transfer remaining assets to a new, secure wallet using a clean device. All connected dApps and browser extensions should be reviewed for unauthorized access, and any suspicious transactions should be reported to the relevant blockchain explorer for further investigation. Additionally, users should monitor their accounts for signs of unauthorized activity and consider revoking all existing wallet authorizations as a precautionary measure. Given the domain's association with brand impersonation, victims should also be vigilant for follow-up phishing attempts via email or social media, as threat actors may attempt to exploit previously collected information.