Phishing sites impersonating Ondo

PhishDestroy has recorded 97 phishing domains impersonating Ondo since 2026-05-13, 89 of them in the last 30 days. The most used registrars are NICENIC and Web Commerce Communications dba WebNic.c; the most common TLDs are .ltd and .finance. Open Ondo only from its official app or a saved bookmark.

97
Domains, all time
89
Last 30 days
3
Online at last check
0
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 02026-08-02: 02026-08-03: 02026-08-04: 02026-08-05: 02026-08-06: 02026-08-07: 02026-08-08: 02026-08-09: 02026-08-10: 02026-08-11: 02026-08-12: 02026-08-13: 02026-08-14: 02026-08-15: 02026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 02026-08-24: 02026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 02026-09-01: 02026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 02026-09-06: 02026-09-07: 02026-09-08: 02026-09-09: 02026-09-10: 02026-09-11: 12026-09-12: 02026-09-13: 02026-09-14: 32026-09-15: 22026-09-16: 02026-09-17: 12026-09-18: 02026-09-19: 02026-09-20: 02026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 12026-09-26: 02026-09-27: 02026-09-28: 02026-09-29: 882026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 02026-10-08: 02026-10-09: 02026-10-10: 02026-10-11: 02026-10-12: 02026-10-13: 02026-10-14: 02026-10-15: 02026-10-16: 02026-10-17: 02026-10-18: 02026-10-19: 02026-10-20: 02026-10-21: 02026-10-22: 0
Ondo phishing domains detected per day: 96 from 2026-07-25 to 2026-10-22; peak 88.

How to tell a fake Ondo site

Words most often added to the brand in reported domains: evergreenfin, api, staging, test, finance, portal, secure, backend, sso, passport.

  • Type the address yourself or use a bookmark; phishing links for Ondo arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Ondo will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Ondo phishing domains

The 50 most recently detected domains impersonating Ondo
DomainFirst detectedStatus at last checkRegistrar
pagos.evergreenfin.ltd2026-09-29OfflineNICENIC
pingtai.evergreenfin.ltd2026-09-29UnknownNICENIC
trace.evergreenfin.ltd2026-09-29UnknownNICENIC
store.evergreenfin.ltd2026-09-29UnknownNICENIC
servicios.evergreenfin.ltd2026-09-29UnknownNICENIC
org.evergreenfin.ltd2026-09-29UnknownNICENIC
ollama.evergreenfin.ltd2026-09-29UnknownNICENIC
mobile.evergreenfin.ltd2026-09-29UnknownNICENIC
federation.evergreenfin.ltd2026-09-29UnknownNICENIC
manage.evergreenfin.ltd2026-09-29UnknownNICENIC
loginpage.evergreenfin.ltd2026-09-29UnknownNICENIC
kr.evergreenfin.ltd2026-09-29UnknownNICENIC
idpage.evergreenfin.ltd2026-09-29UnknownNICENIC
idcenter.evergreenfin.ltd2026-09-29UnknownNICENIC
docs.evergreenfin.ltd2026-09-29OfflineNICENIC
dingtalk.evergreenfin.ltd2026-09-29OfflineNICENIC
cdn.evergreenfin.ltd2026-09-29OfflineNICENIC
stage.evergreenfin.ltd2026-09-29UnknownNICENIC
sso.evergreenfin.ltd2026-09-29UnknownNICENIC
soporte.evergreenfin.ltd2026-09-29UnknownNICENIC
shangjia.evergreenfin.ltd2026-09-29UnknownNICENIC
secure.evergreenfin.ltd2026-09-29UnknownNICENIC
sandbox.evergreenfin.ltd2026-09-29UnknownNICENIC
pgsql.evergreenfin.ltd2026-09-29OfflineNICENIC
platform.evergreenfin.ltd2026-09-29UnknownNICENIC
passportpage.evergreenfin.ltd2026-09-29OfflineNICENIC
passport2.evergreenfin.ltd2026-09-29UnknownNICENIC
passport.evergreenfin.ltd2026-09-29OfflineNICENIC
node.evergreenfin.ltd2026-09-29UnknownNICENIC
mobilebank.evergreenfin.ltd2026-09-29UnknownNICENIC
mgmt.evergreenfin.ltd2026-09-29UnknownNICENIC
melon.evergreenfin.ltd2026-09-29UnknownNICENIC
loginid.evergreenfin.ltd2026-09-29UnknownNICENIC
lk.evergreenfin.ltd2026-09-29UnknownNICENIC
jenkins.evergreenfin.ltd2026-09-29UnknownNICENIC
in.evergreenfin.ltd2026-09-29OfflineNICENIC
ids.evergreenfin.ltd2026-09-29UnknownNICENIC
internal.evergreenfin.ltd2026-09-29UnknownNICENIC
id-sso.evergreenfin.ltd2026-09-29OfflineNICENIC
huiyuanzhongxin.evergreenfin.ltd2026-09-29UnknownNICENIC
huiyuanlogin.evergreenfin.ltd2026-09-29OfflineNICENIC
hehuoren.evergreenfin.ltd2026-09-29UnknownNICENIC
geren.evergreenfin.ltd2026-09-29UnknownNICENIC
federate.evergreenfin.ltd2026-09-29UnknownNICENIC
eu.evergreenfin.ltd2026-09-29UnknownNICENIC
enterprise.evergreenfin.ltd2026-09-29UnknownNICENIC
dashboard.evergreenfin.ltd2026-09-29UnknownNICENIC
clients.evergreenfin.ltd2026-09-29UnknownNICENIC
corp.evergreenfin.ltd2026-09-29OfflineNICENIC
supporto.evergreenfin.ltd2026-09-29UnknownNICENIC

All 97 Ondo reports

Where they are registered and hosted

Registrars

  1. NICENIC94
  2. Web Commerce Communications dba WebNic.c1
  3. TUCOWS.COM1
  4. GNAME.COM1

Top-level domains

  1. .ltd94
  2. .finance1
  3. .mov1
  4. .vc1

Hosting networks

  1. IQWeb FZ-LLC95
  2. Cloudflare, Inc.1
  3. IQWEB IQWeb FZ-LLC, AE1

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Ondo; share of all PhishDestroy reports: 0.04%.