bonkcoin-com[.]pages[.]dev

The domain bonkcoin-com.pages.dev was registered on March 23, 2026 through Cloudflare, Inc. and is currently taken offline, returning an HTTP 403 status code. DNS resolution points to the Cloudflare‑owned IP address 188.114.96.3, which is located in Canada and served by Cloudflare’s edge network (nameservers damon.ns.cloudflare.com and selah.ns.cloudflare.com). The site presented the page title "BONK COIN" and employed a set of front‑end libraries including SweetAlert2, jsDelivr, crypto‑js, cdnjs, as well as Cloudflare features such as HSTS and HTTP/3. SSL was issued by Google Trust Services under the WE1 root, indicating a valid TLS certificate.

Multiple security vendors have flagged the domain: two of ninety‑four VirusTotal scanners raised detections, and the domain appears on four public blocklists. It is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The classification from the intelligence feed is credential phishing, consistent with the elevated risk rating.

While the site is offline, the infrastructure—particularly the use of Cloudflare’s CDN and a valid Google‑signed certificate—suggests an effort to lend legitimacy to the phishing attempt. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor for any re‑hosting attempts on the same IP range, and consider adding the IP address 188.114.96.3 to deny‑list rules. Ongoing vigilance is advised because the underlying hosting provider can be reused for future campaigns, and the presence of legitimate SSL does not mitigate the phishing risk.