redbonk[.]fun

PhishDestroy identifies www.redbonk.fun as an active credential harvesting phishing site under investigation. The domain is engineered to trick users into surrendering sensitive login credentials through deceptive landing pages mimicking legitimate services. Initial risk assessment classifies this as a high-risk threat due to the specific intent to capture user authentication data.

This domain was flagged with the following technical indicators: it resolves to IP address 216.150.1.65, registered through NameCheap, Inc. on June 22, 2025. VirusTotal currently reports 1 out of 95 antivirus engines detecting malicious content. No entries on major blocklists (e.g., PhishTank, OpenPhish) were found at the time of analysis. The SSL certificate issued by Let’s Encrypt adds superficial legitimacy, but does not mitigate the core threat. Trust scores remain critically low due to the domain’s recent creation and absence of established reputation.

To mitigate credential harvesting risks, users should avoid interacting with this domain entirely. If credentials were entered, immediately change passwords on all affected accounts and enable two-factor authentication where available. Organizations should consider blocking the IP address 216.150.1.65 at the network perimeter and reporting the domain to hosting providers and domain registrars. Monitor financial accounts for unusual activity and warn users who may have encountered the site. This is a developing threat; continuous monitoring and user education are essential to prevent credential compromise.