bonk-reward[.]icu

PhishDestroy identifies bonk-reward.icu as a domain engaged in active brand impersonation targeting the Solana ecosystem. The page title 'BONKtrade | Trade RWAs on Solana's #1 Community Exchange' explicitly leverages Solana's branding to deceive visitors into interacting with a counterfeit trading platform. While no crypto drainer kit artifacts have been extracted from available samples, the domain's nomenclature and thematic alignment with Solana's real-world offerings suggest a high-fidelity impersonation campaign designed to harvest user credentials or facilitate unauthorized asset transfers. The absence of a drainer kit in telemetry does not preclude the deployment of obfuscated JavaScript or post-exploitation tooling once victims engage with the fraudulent interface. Threat actors frequently pivot from simple impostor sites to full-featured drainers, particularly when targeting high-value crypto audiences.

Technical indicators for bonk-reward.icu reinforce its malicious classification. The domain resolves to IP address 216.198.79.1 and was registered on April 04, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for loose oversight and frequent abuse. Its SSL certificate, issued by Let's Encrypt, suggests an attempt at legitimacy masking. Critically, the domain exhibits zero VirusTotal detections (10/95 engines) and appears on two public blocklists, indicating either evasion or insufficient detection coverage. The lack of historical telemetry does not diminish its operational status—active blocking by MetaMask and SEAL confirms ongoing malicious intent despite low AV detection rates. The domain’s recent creation and immediate appearance on blocklists further suggest an opportunistic campaign rather than a long-planned infrastructure.

As of current assessment, bonk-reward.icu remains active and under active investigation with risk level marked as 'under_investigation.' Immediate blocking actions have been enforced by multiple security vendors, including MetaMask and SEAL, curtailing access to the fraudulent site. However, the absence of widespread detection (10/95 on VirusTotal) and the domain’s use of a legitimate SSL certificate underscore a significant detection gap that threat actors may exploit. End users should avoid interaction with this domain and treat all Solana-related communications with heightened skepticism. Organizations are advised to implement network-level blocks for IP 216.198.79.1 and domain bonk-reward.icu, and to monitor for related infrastructure under the same registrar. While the immediate risk is mitigated through blocklists, the potential for rapid infrastructure evolution remains high—continuous monitoring and proactive threat hunting are essential to prevent downstream compromise or asset loss.