bonknado[.]cash

This domain, bonknado.cash, is flagged as an elevated-risk crypto drainer phishing site. Analysis indicates it was designed to exploit users by draining cryptocurrency wallets through deceptive transaction prompts or fake wallet interfaces. The domain’s infrastructure and behavioral patterns align with known crypto drainer campaigns, where victims are tricked into signing malicious transactions that transfer funds to attacker-controlled addresses without consent. Infrastructure analysis reveals the domain was registered through Vercel Inc. and resolves to the IP address 66.33.60.34. It is currently offline but was previously detected by 2 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and is blocked by PhishDestroy. Its SSL certificate is issued by Let’s Encrypt, and technologies such as Vercel and HSTS were detected. The Gridinsoft trust score for this domain is 0/100, further corroborating its malicious nature. The page title, 'Bonknado,' does not correspond to any legitimate service, reinforcing its fraudulent intent. Mitigation steps for this crypto drainer threat include immediate blacklisting of the domain and its resolving IP (66.33.60.34) across all network security controls. Organizations should update endpoint protection rules to detect and block interactions with the domain, particularly in environments where cryptocurrency transactions are common. Users who may have interacted with this domain should revoke any active wallet permissions, transfer remaining assets to a new wallet, and monitor transaction histories for unauthorized activity. Security teams are advised to conduct retrospective analysis to identify any prior engagements with the domain and assess potential exposure.