claim[.]bonkcoin[.]ltd

This domain, claim.bonkcoin.ltd, is identified as a brand impersonation threat specifically targeting the Solana ecosystem. Analysis indicates the site masquerades as a legitimate airdrop portal for Bonk, a known Solana-based cryptocurrency, to deceive users into connecting wallets or divulging sensitive credentials. The intent appears to be crypto asset theft, leveraging social engineering tactics to exploit trust in the targeted brand. Infrastructure analysis reveals the domain was designed to closely resemble official crypto distribution events, a common vector for draining wallets or harvesting private keys. Evidence supporting this assessment includes detection by 3 out of 95 security vendors on VirusTotal, a Gridinsoft trust score of 0/100, and presence on one security blocklist. The domain was registered on February 21, 2026, an unusually future date suggesting potential falsification or misconfiguration, and resolves to the IP address 172.67.136.219. The page title, "Bonk | Airdrop," directly aligns with the impersonation of Solana’s Bonk token, further corroborating the fraudulent intent. The domain has since been taken offline, though its prior activity remains a verified risk. Users who visited claim.bonkcoin.ltd should immediately revoke any wallet connections made to the site and monitor their Solana-related accounts for unauthorized transactions. If private keys or seed phrases were entered, affected wallets should be considered compromised, and funds transferred to a new, secure wallet. It is also recommended to scan local devices for malware, as such sites may deploy additional payloads. Given the elevated risk level, vigilance is advised when interacting with unsolicited crypto promotions, particularly those mimicking airdrops or token distributions.