bonchat[.]vip

As of August 01, 2026, the domain bonchat.vip is flagged as a generic phishing site. The domain is currently active and has been blocked by PhishDestroy, indicating that it is recognized as a potential threat by at least one security service. The domain uses Cloudflare nameservers (anderson.ns.cloudflare.com and mariah.ns.cloudflare.com), which are common for both legitimate and malicious sites. The SSL certificate for bonchat.vip is issued by Google Trust Services, specifically under the WE1 designation.

This certificate provides encryption for the site but does not inherently indicate the site's legitimacy. The domain resolves to the IP address 188.114.97.3. While the IP address alone does not reveal the hosting provider's reputation, it is an important data point for further investigation. The domain appears on one security blocklist, which suggests that it has been identified as a threat by at least one security organization.

However, the exact content and purpose of the site have not been fully analyzed, and the specific nature of the phishing campaign remains under investigation. Defenders should exercise caution and consider blocking this domain until further evidence is gathered and the risk is fully assessed. It is also advisable to monitor for any related domains or IP addresses that may be part of the same campaign. The absence of detections from multiple vendors does not guarantee the domain's safety, and additional scrutiny is warranted.