ondoglobal[.]co

This domain, ondoglobal.co, is actively engaged in brand impersonation phishing targeting Ondo Finance, a legitimate cryptocurrency platform. The site presents itself as an official Ondo Finance portal, using identical branding elements, including the page title 'Explore | Ondo Finance,' to deceive users into disclosing sensitive credentials or transferring assets. Analysis indicates the domain is currently active and resolving to infrastructure associated with malicious activity. Infrastructure analysis reveals the domain was registered on June 25, 2026, through Global Domain Group LLC, a registrar frequently observed in phishing campaigns. It resolves to the IP address 188.114.96.3 and has been flagged by 1 of 95 security vendors on VirusTotal. Additionally, the domain appears on three security blocklists and has been referenced in two AlienVault OTX threat intelligence pulses. The creation date discrepancy—registered in 2026—suggests potential domain spoofing or registry manipulation to evade detection. The domain remains active and poses a high risk to users of Ondo Finance and the broader cryptocurrency community. Organizations and individuals are advised to block the domain and its resolving IP at the network perimeter. End-users should verify the legitimacy of any Ondo Finance-related communication by cross-referencing official channels and avoiding interaction with ondoglobal.co. Security teams are encouraged to monitor for related domains registered under the same registrar or resolving to the same IP infrastructure.