# Phishing sites impersonating Ondo PhishDestroy has recorded 97 phishing domains impersonating Ondo since 2026-05-13, 89 of them in the last 30 days. The most used registrars are NICENIC and Web Commerce Communications dba WebNic.c; the most common TLDs are .ltd and .finance. Open Ondo only from its official app or a saved bookmark. 97Domains, all time 89Last 30 days 3Online at last check 0Confirmed takedowns ## New domains in the last 90 days Ondo phishing domains detected per day: 96 from 2026-07-25 to 2026-10-22; peak 88. ## How to tell a fake Ondo site Words most often added to the brand in reported domains: evergreenfin, api, staging, test, finance, portal, secure, backend, sso, passport. - Type the address yourself or use a bookmark; phishing links for Ondo arrive through ads, search results, direct messages and fake support accounts. - Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters. - Ondo will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets. Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check). ## Latest Ondo phishing domains The 50 most recently detected domains impersonating Ondo Domain | First detected | Status at last check | Registrar | [pagos.evergreenfin.ltd](https://phishdestroy.io/domain/pagos.evergreenfin.ltd/) | 2026-09-29 | Offline | NICENIC | [pingtai.evergreenfin.ltd](https://phishdestroy.io/domain/pingtai.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [trace.evergreenfin.ltd](https://phishdestroy.io/domain/trace.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [store.evergreenfin.ltd](https://phishdestroy.io/domain/store.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [servicios.evergreenfin.ltd](https://phishdestroy.io/domain/servicios.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [org.evergreenfin.ltd](https://phishdestroy.io/domain/org.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [ollama.evergreenfin.ltd](https://phishdestroy.io/domain/ollama.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [mobile.evergreenfin.ltd](https://phishdestroy.io/domain/mobile.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [federation.evergreenfin.ltd](https://phishdestroy.io/domain/federation.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [manage.evergreenfin.ltd](https://phishdestroy.io/domain/manage.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [loginpage.evergreenfin.ltd](https://phishdestroy.io/domain/loginpage.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [kr.evergreenfin.ltd](https://phishdestroy.io/domain/kr.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [idpage.evergreenfin.ltd](https://phishdestroy.io/domain/idpage.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [idcenter.evergreenfin.ltd](https://phishdestroy.io/domain/idcenter.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [docs.evergreenfin.ltd](https://phishdestroy.io/domain/docs.evergreenfin.ltd/) | 2026-09-29 | Offline | NICENIC | [dingtalk.evergreenfin.ltd](https://phishdestroy.io/domain/dingtalk.evergreenfin.ltd/) | 2026-09-29 | Offline | NICENIC | [cdn.evergreenfin.ltd](https://phishdestroy.io/domain/cdn.evergreenfin.ltd/) | 2026-09-29 | Offline | NICENIC | [stage.evergreenfin.ltd](https://phishdestroy.io/domain/stage.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [sso.evergreenfin.ltd](https://phishdestroy.io/domain/sso.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [soporte.evergreenfin.ltd](https://phishdestroy.io/domain/soporte.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [shangjia.evergreenfin.ltd](https://phishdestroy.io/domain/shangjia.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [secure.evergreenfin.ltd](https://phishdestroy.io/domain/secure.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [sandbox.evergreenfin.ltd](https://phishdestroy.io/domain/sandbox.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [pgsql.evergreenfin.ltd](https://phishdestroy.io/domain/pgsql.evergreenfin.ltd/) | 2026-09-29 | Offline | NICENIC | [platform.evergreenfin.ltd](https://phishdestroy.io/domain/platform.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [passportpage.evergreenfin.ltd](https://phishdestroy.io/domain/passportpage.evergreenfin.ltd/) | 2026-09-29 | Offline | NICENIC | [passport2.evergreenfin.ltd](https://phishdestroy.io/domain/passport2.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [passport.evergreenfin.ltd](https://phishdestroy.io/domain/passport.evergreenfin.ltd/) | 2026-09-29 | Offline | NICENIC | [node.evergreenfin.ltd](https://phishdestroy.io/domain/node.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [mobilebank.evergreenfin.ltd](https://phishdestroy.io/domain/mobilebank.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [mgmt.evergreenfin.ltd](https://phishdestroy.io/domain/mgmt.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [melon.evergreenfin.ltd](https://phishdestroy.io/domain/melon.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [loginid.evergreenfin.ltd](https://phishdestroy.io/domain/loginid.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [lk.evergreenfin.ltd](https://phishdestroy.io/domain/lk.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [jenkins.evergreenfin.ltd](https://phishdestroy.io/domain/jenkins.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [in.evergreenfin.ltd](https://phishdestroy.io/domain/in.evergreenfin.ltd/) | 2026-09-29 | Offline | NICENIC | [ids.evergreenfin.ltd](https://phishdestroy.io/domain/ids.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [internal.evergreenfin.ltd](https://phishdestroy.io/domain/internal.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [id-sso.evergreenfin.ltd](https://phishdestroy.io/domain/id-sso.evergreenfin.ltd/) | 2026-09-29 | Offline | NICENIC | [huiyuanzhongxin.evergreenfin.ltd](https://phishdestroy.io/domain/huiyuanzhongxin.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [huiyuanlogin.evergreenfin.ltd](https://phishdestroy.io/domain/huiyuanlogin.evergreenfin.ltd/) | 2026-09-29 | Offline | NICENIC | [hehuoren.evergreenfin.ltd](https://phishdestroy.io/domain/hehuoren.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [geren.evergreenfin.ltd](https://phishdestroy.io/domain/geren.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [federate.evergreenfin.ltd](https://phishdestroy.io/domain/federate.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [eu.evergreenfin.ltd](https://phishdestroy.io/domain/eu.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [enterprise.evergreenfin.ltd](https://phishdestroy.io/domain/enterprise.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [dashboard.evergreenfin.ltd](https://phishdestroy.io/domain/dashboard.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [clients.evergreenfin.ltd](https://phishdestroy.io/domain/clients.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [corp.evergreenfin.ltd](https://phishdestroy.io/domain/corp.evergreenfin.ltd/) | 2026-09-29 | Offline | NICENIC | [supporto.evergreenfin.ltd](https://phishdestroy.io/domain/supporto.evergreenfin.ltd/) | 2026-09-29 | Unknown | NICENIC | [All 97 Ondo reports](https://phishdestroy.io/domain/?brand=Ondo) ## Where they are registered and hosted ### Registrars - [NICENIC](https://phishdestroy.io/registrar/nicenic/)94 - [Web Commerce Communications dba WebNic.c](https://phishdestroy.io/registrar/webnic/)1 - [TUCOWS.COM](https://phishdestroy.io/registrar/tucows/)1 - [GNAME.COM](https://phishdestroy.io/registrar/name-com/)1 ### Top-level domains - [.ltd](https://phishdestroy.io/tld/ltd/)94 - [.finance](https://phishdestroy.io/tld/finance/)1 - .mov1 - [.vc](https://phishdestroy.io/tld/vc/)1 ### Hosting networks - IQWeb FZ-LLC95 - Cloudflare, Inc.1 - IQWEB IQWeb FZ-LLC, AE1 ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [Homoglyph](https://phishdestroy.io/glossary/homoglyph/) - [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/) - [Wallet drainer](https://phishdestroy.io/glossary/wallet-drainer/) - [Seed phrase phishing](https://phishdestroy.io/glossary/seed-phrase-phishing/) - [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) - [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator) - [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action) - [All impersonated brands](https://phishdestroy.io/brand/) Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Ondo; share of all PhishDestroy reports: 0.04%. Canonical: https://phishdestroy.io/brand/ondo/