bonk-rewards[.]click

Analysis of bonk-rewards.click indicates that the domain was registered on September 10, 2025 through NameSilo, LLC and is currently resolved to the Cloudflare address 172.67.203.20, belonging to ASN 13335 (Cloudflare, Inc.) in the United States. The site presents the HTTP response title “Just a moment…”, and no TLS certificate is associated with the host, confirming that the service is delivered over plain HTTP. VirusTotal has recorded two detections out of ninety‑five scanning engines, confirming that at least a small subset of security vendors have identified malicious behavior. The domain is listed on a single external blocklist and has been actively blocked by the PhishDestroy service.

Additional reputation data shows a Gridinsoft trust score of zero out of one hundred, indicating an extremely low confidence rating. The authoritative nameservers are angela.ns.cloudflare.com and kevin.ns.cloudflare.com, both owned by Cloudflare, which is consistent with the observed IP address. The available evidence supports a classification of generic phishing, yet the exact payload or targeted brand has not been disclosed; the page title provides no further context, and no additional content has been captured. Consequently, the precise tactics, techniques, and procedures employed by the operators remain uncertain, as does any potential victim interaction beyond the initial landing page.

Defenders should add bonk-rewards.click to internal block and deny lists, monitor DNS queries for the associated Cloudflare IP range, and consider extending outbound filtering to include the identified nameservers. Because the domain is already offline, ongoing observation of related indicators—such as the registrar, hosting ASN, and any future re‑registration attempts—will help mitigate re‑use. Continuous re‑scanning with multi‑vendor services is recommended to capture any changes in detection status.