bonusbnb[.]net

This domain, bonusbnb.net, is identified as a crypto drainer phishing site specifically designed to impersonate LiquidBNB, a cryptocurrency platform. The site employs deceptive tactics to trick users into connecting their digital wallets, subsequently draining funds through malicious smart contract interactions. Analysis of the domain reveals it is engineered to harvest wallet credentials and execute unauthorized transactions, posing a direct financial threat to visitors. Infrastructure analysis provides concrete indicators of malicious intent. The domain was registered on October 12, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.4.67 and is currently flagged by 1 security blocklist. Detection engines report 2 out of 95 vendors on VirusTotal have classified this domain as malicious, with a Gridinsoft trust score of 0/100. The site utilizes Cloudflare for hosting and protection, a common tactic to obscure origin servers and evade takedowns. Technologies detected include AngularJS, jQuery, and Smartsupp, which are often leveraged to create convincing fake interfaces. Users who visited bonusbnb.net should take immediate action to mitigate potential financial loss. Disconnect any cryptocurrency wallets linked to the site and revoke permissions for any suspicious smart contracts. Monitor wallet activity for unauthorized transactions and consider transferring remaining funds to a new wallet if compromise is suspected. Report the domain to relevant cybersecurity organizations to aid in broader threat intelligence efforts. Given the elevated risk level and the domain’s current offline status, users are advised to remain vigilant against similar phishing attempts targeting cryptocurrency platforms.