buckybonk[.]com

buckybonk.com was observed delivering a tech‑support scam that masquerades as Google, as indicated by the brand target field. The domain was created on 5 August 2025 and currently resolves to 13.248.243.5, which belongs to the Amazon.com, Inc. network (AS16509) located in the United States. HTTP requests return status 200 and the site presents a valid TLS certificate issued by a commercial certificate authority. Infrastructure analysis shows the domain uses the registrar’s default nameservers ns71.domaincontrol.com and ns72.domaincontrol.com and is built with a website‑builder platform that includes RequireJS, a reCAPTCHA challenge, and a live‑chat widget. HSTS is enforced. The site appears on a single security blocklist and is listed by PhishDestroy; one of ninety‑five VirusTotal scanners flagged the domain. Gridinsoft’s trust score is 0 out of 100, indicating a high likelihood of malicious intent. The page title returned by the HTTP response is “buckybonk.com”, providing no additional context. The investigation confirms active, high‑risk status, but the exact content and user‑interaction flow have not been captured. Defenders should block the domain at network perimeters, add it to internal blocklists, and monitor the associated IP range for related activity. Continuous re‑evaluation is advised as further intelligence becomes available.