bonk-coin[.]net

This domain is flagged as a high-risk generic phishing threat. Registered on January 3, 2026, via PDR Ltd. d/b/a PublicDomainRegistry.com, the domain remains active and resolves to IP 104.21.40.5, hosted by Cloudflare (AS13335) in the United States. The page title is 'Nur einen Moment…', a generic German phrase meaning 'Just a moment…', which is often used as a placeholder or loading screen in phishing campaigns. SSL is issued by Google Trust Services WE1. The domain is blocked by PhishDestroy, ScamSniffer, and Enkrypt, and appears on three security blocklists. AlienVault OTX includes it in one threat intelligence pulse. VirusTotal reports 3 of 93 vendors flagging the domain as malicious. Scamadviser trust score is 35/100, and Gridinsoft trust score is 0/100, both indicating high risk. The HTTP status is 403 Forbidden, suggesting the server may be blocking direct access or presenting a restricted page. Infrastructure analysis reveals Cloudflare as the CDN and DNS provider via nameservers cosmin.ns.cloudflare.com and joselyn.ns.cloudflare.com, with HTTP/3 support. The exact content of the site has not been analysed beyond the page title, so the specific phishing lure or target brand is unconfirmed. Defenders should treat this domain as actively hostile, block all outbound connections to it, and monitor for any internal traffic or user reports interacting with it. Given the low trust scores and multi-source blocklisting, immediate denial-of-access measures are recommended. No further intelligence on the phishing kit or victim sector is available at this time.