bonkrewardbonus[.]pages[.]dev

The domain bonkrewardbonus.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently listed as offline with an HTTP 403 response. DNS resolution points to 172.66.44.168, an address owned by Cloudflare (AS13335) located in the United States. The authoritative nameservers are peaches.ns.cloudflare.com and damien.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. TLS termination is provided by a Google Trust Services certificate issued to the WE1 entity, and the site enforces HSTS while supporting HTTP/3, indicating a modern web stack despite the malicious intent.

The page title returned on the blocked request is "DebbugDappNode," which does not directly reference the targeted brand. The threat actor is impersonating Avalanche and advertises a fake airdrop, a classic brand‑impersonation lure. The domain appears on a single security blocklist (PhishDestroy) and has a Gridinsoft trust score of 0 / 100, reflecting a high confidence of malicious behavior. VirusTotal reports that 93 scanning engines have examined the domain and none have flagged it, but the absence of detections does not constitute a safety guarantee.

For defenders, the immediate recommendation is to add bonkrewardbonus.pages.dev to web‑filter deny lists and to monitor the associated IP address for any re‑activation or new hostnames. Continuous observation of Cloudflare‑originated IP ranges for similar naming patterns is advised, as the infrastructure can be rapidly repurposed. Incident response teams should also flag any internal communications referencing Avalanche airdrops and verify authenticity before any user interaction. Although the site is presently offline, the infrastructure footprint suggests the actor can redeploy the lure elsewhere, so proactive blocking and threat‑intel sharing remain essential.