avaxbonus[.]com

This domain, avaxbonus.com, is identified as a confirmed phishing site specializing in brand impersonation targeting Avalanche, a major blockchain platform. The site was designed to deceive users into disclosing sensitive credentials or transferring cryptocurrency under false pretenses. Analysis indicates the domain is currently offline, though prior activity suggests it was actively used for malicious purposes. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on September 13, 2025, and resolved to the IP address 104.21.37.125. It has been flagged by 2 of 95 security vendors on VirusTotal and appears on 4 distinct security blocklists, including entries from Polkadot, Codeesura, PhishDestroy, and Enkrypt. The site employed AngularJS and jQuery frameworks, alongside Cloudflare’s infrastructure, to facilitate its operations. The SSL certificate was issued by Google Trust Services, and the Gridinsoft trust score for this domain is 0 out of 100, indicating a high-risk classification. Given the domain’s current offline status, immediate threats to users are mitigated; however, the infrastructure and registration details remain suspicious. Organizations and individuals are advised to maintain blocklist entries for this domain and monitor for any reactivation attempts. Network administrators should inspect logs for connections to 104.21.37.125 or related domains registered through the same provider. Users who may have interacted with this site should revoke any associated credentials and monitor accounts for unauthorized activity. Proactive measures, such as domain reputation checks and endpoint protection updates, are recommended to prevent exposure to similar threats.