claim[.]bonk-coin[.]pw

The domain claim.bonk-coin.pw was registered on December 30, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently listed as offline. DNS resolution points to the Cloudflare‑managed address 188.114.97.3, hosted within AS13335 in the United States. Both authoritative nameservers—aaden.ns.cloudflare.com and jewel.ns.cloudflare.com—are Cloudflare endpoints, indicating that the attacker leveraged the provider’s CDN and DDoS mitigation services to obscure the true origin of the payload. No TLS certificate was observed for the domain, meaning any HTTP traffic would be transmitted without encryption, a common characteristic of opportunistic crypto‑drainer campaigns that rely on rapid redirection rather than credential harvesting.

The sole visible HTML element is the page title "Just a moment...", which provides no insight into the page’s intended functionality. Gridinsoft’s trust scoring system assigned a rating of 0 out of 100, reflecting a complete lack of credibility. VirusTotal reported a single positive detection out of 93 scanning engines, confirming that at least one security vendor identified malicious activity associated with the host. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy mitigation service.

The listed scam type is "Crypto Scam" and the risk level is elevated, consistent with the observed infrastructure and detection profile. Analysis indicates that the domain was likely used as a drop‑point for a crypto‑drainer payload, possibly intended to lure victims into authorizing fraudulent cryptocurrency transactions. The absence of SSL, combined with the reliance on Cloudflare’s edge network, suggests the operator prioritized speed and anonymity over data confidentiality. While the exact content of the page remains unverified beyond its title, the low trust score, single vendor flag, and blocklist presence collectively support the elevated risk assessment.