bonatas[.]com

Analysis of bonatas.com, a domain created on April 01, 2025 and registered through Hostinger operations UAB, indicates a confirmed brand impersonation campaign targeting the MetaMask brand. The site resolves to the IPv6 address 2a02:4780:3f:1896:0:2539:915b:5, which maps to a Hostinger International Limited network (AS47583) located in Germany. DNS resolution is served by ns1.dns-parking.com and ns2.dns-parking.com, typical of parked domains, and the site currently returns an offline HTTP status, confirming that it is no longer accessible. The page title retrieved prior to takedown was "Bonatas — Crypto Loans," suggesting an attempt to lure victims with a financial‑themed offering.

No TLS certificate is present, leaving the site without encryption. Reputation services show a Gridinsoft trust score of 0 / 100, and the domain appears on four independent security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. VirusTotal analysis recorded a single detection out of ninety‑five scanners, reinforcing the malicious classification.

The combination of a brand‑specific impersonation claim, the absence of security controls, and multiple blocklist listings provides concrete evidence of a phishing infrastructure. Defenders should continue to block the IPv6 address and associated hostnames, update URL filtering rules to include bonatas.com, and monitor for newly registered domains that use similar naming patterns or the same hosting provider. Threat intelligence feeds should be enriched with the observed indicators, and incident response teams should verify any related MetaMask credential submissions for potential compromise.