wlfirewardbonus[.]pages[.]dev

The domain wlfirewardbonus.pages.dev is a phishing site engaged in brand impersonation targeting the Avalanche cryptocurrency platform. It operated as an airdrop scam, falsely promising rewards to trick users into disclosing sensitive information or connecting wallets. No crypto drainer kit was detected. The site is currently taken offline, but users who interacted with wlfirewardbonus.pages.dev should remain cautious.

Technical analysis shows wlfirewardbonus.pages.dev was flagged by 1 of 95 VirusTotal security vendors, including Ermes, and was explicitly marked by Google Safe Browsing for 'SOCIAL_ENGINEERING'. The domain appeared on 1 security blocklist (PhishDestroy) and was registered through Cloudflare, Inc. on September 08, 2025. It resolved to the IP address 172.66.44.175, hosted by Cloudflare in the US (AS13335), and used an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'DebbugDappNode', and the site employed technologies such as HSTS, Cloudflare, and HTTP/3. Gridinsoft assigned a trust score of 0/100, while Scamadviser rated it 41/100.

Users who visited wlfirewardbonus.pages.dev should immediately revoke any token approvals granted to unknown contracts and consider transferring funds to a new wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication. Report the domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand (Avalanche) to aid in takedown efforts. Monitor accounts for unauthorized transactions or suspicious activity.