bonkbot-connect[.]pages[.]dev

PhishDestroy identifies bonkbot-connect.pages.dev as an active crypto drainer domain impersonating Bonkbot, a popular Solana-based memecoin trading bot. This fraudulent site leverages Cloudflare Pages hosting to distribute malicious payloads designed to exfiltrate cryptocurrency wallet credentials or execute unauthorized token transfers. The domain masquerades as a legitimate Bonkbot connectivity tool, likely distributed via social engineering tactics on platforms like Twitter or Discord where Bonkbot discussions occur. Users tricked into connecting their wallets risk falling victim to wallet drainers that silently approve malicious token approvals or execute arbitrary transactions.

This domain was flagged by PhishDestroy with zero VirusTotal detections out of 95 scanners (0/95), indicating it currently evades traditional antivirus coverage. The domain resolves to IP 172.66.47.45 via Cloudflare, Inc. and holds an SSL certificate issued by Google Trust Services. While the registration date is not specified in the data, the active threat status suggests recent deployment. The lack of detections highlights the evolving nature of these attacks, which often bypass blacklists during initial campaigns.

If you visited bonkbot-connect.pages.dev and connected a wallet, immediately revoke any unauthorized token approvals using tools like revoke.cash or Phantom’s built-in revoke feature. Disconnect the wallet from the site and scan for malware using reputable security software. Report the domain to Bonkbot’s official support channels and block it to prevent further exposure. Avoid entering seed phrases or private keys under any circumstances, as legitimate platforms never request such information via links or pop-ups.