prize-ondo[.]org

prize-ondo.org is currently active and has been identified as a high‑risk generic phishing infrastructure. The domain resolves to Cloudflare IP 172.67.177.42 and uses the Cloudflare nameservers kayleigh.ns.cloudflare.com and langston.ns.cloudflare.com. A valid Let’s Encrypt certificate (YE1) is present and HTTP requests receive a 301 redirect. Registration data shows the domain was created by NICENIC INTERNATIONAL GROUP CO., LIMITED. Threat intelligence sources list the domain in two AlienVault OTX pulses and on three public blocklists; it is also blocked by PhishDestroy, MetaMask and SEAL. VirusTotal scans report seven detections out of ninety‑one scanners. The available data do not include a page‑level analysis, so the specific lure or credential‑stealing page content remains unknown. Infrastructure indicators suggest the operator is leveraging Cloudflare’s CDN to hide origin servers. Defenders should add prize-ondo.org to deny‑list rules, enforce DNS sink‑holing, and monitor for related C2 traffic. Ongoing observation is advised to capture any future payloads or phishing pages that may be deployed.