claim-bonk[.]icu

Analysis of the domain claim-bonk.icu indicates it was operational as a crypto drainer scam, classified under elevated risk due to confirmed malicious activity. The domain was registered on December 03, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, with no SSL certificate present, which is atypical for legitimate financial or crypto-related services. Infrastructure analysis reveals it resolved to IP 188.114.96.3, hosted on Cloudflare's network (AS13335), a common tactic to obscure origin and evade IP-based blocking. Nameservers james.ns.cloudflare.com and meiling.ns.cloudflare.com further confirm Cloudflare usage.

At the time of assessment, the domain was flagged by 5 of 95 security vendors on VirusTotal, though this detection rate is not conclusive evidence of maliciousness alone. The page title 'Nur einen Moment…' suggests a temporary or redirect page, which may have been used to mask the true payload or evade automated crawlers. The domain appears on one security blocklist and was blocked by PhishDestroy, corroborating its malicious classification. No brand impersonation is explicitly confirmed in the available data, though the domain name implies a connection to the Bonk cryptocurrency or related services.

Defenders should treat this domain as compromised and prioritize blocking it at DNS, proxy, and endpoint levels. Historical logs should be reviewed for connections to 188.114.96.3 or interactions with the domain post-December 2025. Given its offline status as of July 24, 2026, no active threat is present, but monitoring for re-registration or similar domains (e.g., typosquatting variants) is recommended. The lack of SSL and low trust scores (Gridinsoft: 0/100) align with known crypto drainer infrastructure patterns.