reg-fnde-ondo[.]com

This domain, reg-fnde-ondo.com, is flagged as an active phishing infrastructure designed to impersonate financial onboarding portals, likely targeting users of cryptocurrency or banking services. Analysis indicates the site employs social engineering tactics to harvest login credentials, private keys, or other sensitive financial data. While no specific drainer kit has been conclusively identified, the domain exhibits characteristics consistent with credential harvesting and wallet-draining campaigns, including the use of Cloudflare for obfuscation and HTTP/3 for rapid data exfiltration. Infrastructure analysis reveals the following technical indicators: the domain is detected by 6 out of 95 security vendors on VirusTotal, with a creation date of June 12, 2026, suggesting either a typo-squatting attempt or an advanced registration to evade immediate detection. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain appears on three security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL. The SSL certificate is issued by Google Trust Services, which, while legitimate, is commonly exploited by threat actors to lend false credibility to phishing sites. No Google Safe Browsing (GSB) data is currently available, but the domain's presence in four AlienVault OTX threat intelligence pulses further corroborates its malicious intent. As of the latest assessment, reg-fnde-ondo.com remains active and poses an elevated risk to users. Response actions by security providers have included blocklisting and browser-based warnings, but the domain continues to resolve and may still be reachable through direct navigation or phishing links. The use of Cloudflare and HTTP/3 complicates takedown efforts and enables rapid rotation of hosting infrastructure. Users are advised to treat this domain as hostile and avoid interaction. Organizations should update blocklists to include this domain and monitor for related indicators of compromise, such as unusual login attempts or unauthorized transactions originating from exposed credentials. Proactive measures, including multi-factor authentication and endpoint detection rules, are recommended to mitigate residual risk.