wlfibodsf[.]pages[.]dev

The domain wlfibodsf.pages.dev has been confirmed as a brand_impersonation phishing site targeting users of the Solana cryptocurrency platform. Analysis indicates the site was operational under the guise of a fraudulent cryptocurrency offering, specifically masquerading as a distribution or investment opportunity related to BONK COIN. The domain is currently offline, though prior activity and infrastructure details remain relevant for threat assessment. Infrastructure analysis reveals the domain was registered on September 01, 2025, through Cloudflare, Inc., and resolved to the IP address 172.66.44.171, which is geolocated in the United States under AS13335. Security vendor detection metrics indicate that 8 of 95 engines on VirusTotal flagged the domain as malicious. The domain appears on two distinct security blocklists, and its SSL certificate was issued by Google Trust Services, bearing the identifier WE1. The page title, BONK COIN, aligns with known tactics used to deceive users into believing they are interacting with legitimate cryptocurrency platforms or token distributions. Current status confirms the domain has been taken offline, though the associated infrastructure may remain dormant or repurposed for future campaigns. Organizations and users are advised to block the domain and IP address at the network level to prevent accidental exposure. Cryptocurrency wallet addresses or transaction hashes linked to this domain should be treated as high-risk and reported to relevant financial security platforms. Continuous monitoring of related domains registered through the same registrar or resolving to adjacent IP ranges is recommended to mitigate potential follow-up threats.