avax-bonus[.]com

Analysis indicates avax-bonus.com was registered on September 14, 2025 through NiceNIC International Group Co., Limited. The domain resolves to the Cloudflare address 172.67.197.189, which is associated with AS13335 Cloudflare, Inc. in the United States. The authoritative name servers are anderson.ns.cloudflare.com and dorthy.ns.cloudflare.com, confirming that the site is hosted behind Cloudflare's CDN. No TLS certificate was observed, and the site currently returns an offline HTTP status, consistent with the reported “taken offline” state. The page title retrieved during prior scans reads “Avalaunch – Future of Fundraising,” which aligns with a crypto‑related narrative and matches the declared scam type of a crypto scam.

The domain is explicitly marked as impersonating the Avalanche brand. Reputation services assign extremely low trust scores: Gridinsoft rates the domain 0 out of 100, and Scamadviser rates it 1 out of 100. The domain appears on one security blocklist and has been blocked by PhishDestroy. AlienVault OTX references the domain in a single threat‑intelligence pulse. VirusTotal analysis shows that seven of ninety‑five security vendors flagged the domain, reinforcing the malicious assessment.

Given the combination of a brand‑specific title, low trust scores, blocklist presence, and multiple vendor detections, the infrastructure is highly indicative of a fraudulent operation targeting cryptocurrency investors. However, the current offline status prevents direct observation of the payload or user‑interaction mechanisms, leaving the exact phishing workflow uncertain. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any re‑hosting attempts that may use the same IP address or Cloudflare name servers. Threat‑intel teams should correlate the observed IP and registrar details with other known Avalanche‑related abuse campaigns to identify potential shared infrastructure.