avabonus[.]pages[.]dev

This domain is currently under investigation for generic phishing activity, specifically targeting users with fraudulent blockchain-based loyalty and rewards schemes. The risk level remains unconfirmed pending further analysis, but initial indicators suggest potential malicious intent. Infrastructure analysis reveals the domain avabonus.pages.dev was registered on May 04, 2026, through Cloudflare, Inc. It resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (serial number E7). Despite its recent creation and association with a known content delivery network, the domain appears on one security blocklist (PhishDestroy) and has a VirusTotal detection score of 0/95. The page title, 'AVA Foundation – Loyalty & Rewards on the Blockchain,' aligns with common phishing themes exploiting cryptocurrency and decentralized finance trends. Mitigation steps for this threat type include blocking the domain at the DNS or firewall level, particularly in environments where cryptocurrency-related activity is discouraged. Network administrators should monitor for connections to 188.114.96.3 and inspect SSL certificates with the serial number E7 for potential impersonation attempts. End users should be educated to verify the legitimacy of blockchain reward programs through official channels and avoid interacting with unsolicited offers, especially those hosted on newly registered or untrusted domains. If the domain is encountered in corporate or financial environments, it should be reported to internal security teams for further investigation.