# PhishDestroy domain threat record: ondostaking.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/ondostaking.com/ Machine-readable companion: https://phishdestroy.io/domain/ondostaking.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-22 13:11:36 UTC - Last availability or vendor check: 2026-10-22 13:11:36 UTC - Stored record updated: 2026-10-22 16:30:29 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: ScamSniffer - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Ethereum ## Stored infrastructure - Observed IP address: 104.21.59.18 - Registrar in stored WHOIS data: GMO Internet Group, Inc. d/b/a Onamae.com - Last stored HTTP status: 200 - Registration date (registry RDAP, ondostaking.com): 2026-10-13 01:12:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a163bb-8435-74ea-86a7-219947dc598c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/ondostaking.com - Certificate Transparency search: https://crt.sh/?q=%25.ondostaking.com - Web Archive lookup: https://web.archive.org/web/*/https://ondostaking.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake system classified ondostaking.com as malicious after an admin report and an AI‑generated phishing confidence of 90 %. The recorded page title reads “ONDO Staking — Stake ONDO Token on Ethereum”, which the assessment interpreted as a fake staking service. PhishDestroy first observed the domain on 2026-10-22, nine days after its registration on 2026-10-13, and the HTTP response at that time was 200. How the scam works Fraudulent staking pages impersonate legitimate crypto projects and lure victims into connecting wallets or revealing private keys by promising high yields or rewards. No actual staking occurs; instead the operator can drain any assets or approve malicious transactions once access is granted. Evidence VirusTotal scanned the domain on 2026-10-22 and reported 0 detections from 92 engines. Google Safe Browsing checked the same day and did not flag the site. OTX listed four pulses referencing the domain on 2026-10-22, and the external blocklist ScamSniffer also includes it. PhishDestroy’s internal blocklist marks the domain as malicious, while urlscan.io’s engine analysis on 2026-10-22 gave a malicious score of 85 though its overall verdict was non‑malicious. Cloudflare Radar identified the domain as phishing on 2026-10-22. Infrastructure The domain was registered with GMO Internet Group (Onamae.com) on 2026-10-13 and resolves to Cloudflare IP addresses 104.21.59.18 and 172.67.167.150, recorded in Canada. The TLS certificate, issued by Let’s Encrypt on 2026-10-13, is valid until 2027-01-11 and covers *.ondostaking.com; DNSSEC is not enabled. What to do Avoid connecting any wallet or entering seed phrases on ondostaking.com. Users who may have entered credentials should treat the wallet as compromised, create a new secure wallet, and monitor associated accounts for unauthorized activity. Organizations should block the domain and its recorded IPs at the firewall, review access logs for connections, and add the domain to threat‑intel feeds. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a163bb-8435-74ea-86a7-219947dc598c/ Cloudflare Radar report: https://radar.cloudflare.com/scan/acd7873b-1799-424c-9882-9106dbe095fa URLQuery report: https://urlquery.net/report/e7ba18cd-c639-47ff-b95e-f30a72453440 Stored capture screenshot: https://i.ibb.co/6cgDxWxx/e30c51d9c01c.png Cloudflare Radar screenshot (2026-10-22T13:48:53Z): https://screenshots.phishdestroy.io/cf/acd7873b-1799-424c-9882-9106dbe095fa.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/e7ba18cd-c639-47ff-b95e-f30a72453440.png URLScan screenshot (2026-10-22T13:23:09Z): https://screenshots.phishdestroy.io/us/01a163c7-6a16-7369-af8b-62963c35ddb3.png URLScan capture report: https://urlscan.io/result/01a163c7-6a16-7369-af8b-62963c35ddb3/ VirusTotal report: https://www.virustotal.com/gui/domain/ondostaking.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ondostaking.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-22 13:54:29 UTC ## Stored page captures - Primary capture: https://i.ibb.co/6cgDxWxx/e30c51d9c01c.png Captured: 2026-10-22 13:11:36 UTC - URLScan capture: https://urlscan.io/screenshots/01a163bb-8435-74ea-86a7-219947dc598c.png Captured: 2026-10-22 13:11:36 UTC Source report: https://urlscan.io/result/01a163bb-8435-74ea-86a7-219947dc598c/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/acd7873b-1799-424c-9882-9106dbe095fa.png Captured: 2026-10-22 13:48:53 UTC Source report: https://radar.cloudflare.com/scan/acd7873b-1799-424c-9882-9106dbe095fa SHA-256: 3812751c55f4d5ca6f04407fa7d0bf62f47b7507ea5f571863d24ce91308d124 - URLQuery: https://screenshots.phishdestroy.io/uq/e7ba18cd-c639-47ff-b95e-f30a72453440.png Source report: https://urlquery.net/report/e7ba18cd-c639-47ff-b95e-f30a72453440 SHA-256: 08b77229b05734bec10890ca94a4bb806fbebd6d8dde430a257af95f13e3873c - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163c7-6a16-7369-af8b-62963c35ddb3.png Captured: 2026-10-22 13:23:09 UTC Source report: https://urlscan.io/result/01a163c7-6a16-7369-af8b-62963c35ddb3/ SHA-256: 556a8bbd38fa24356c6a8d7c58c57db34b4066aa44a4922f3225a86cf106deef ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T13:51:48Z", "uuid": "01a163bb-8435-74ea-86a7-219947dc598c", "scanned_at": "2026-10-22T13:10:17Z", "final_url": "https://ondostaking.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://ondostaking.com/", "from": "http://ondostaking.com/", "status": 307 } ], "ip": "172.67.167.150", "domains": [ "s2.coinmarketcap.com", "fonts.gstatic.com", "api.coingecko.com", "static.cloudflareinsights.com", "fonts.googleapis.com" ], "ips": [ "13.226.209.39", "104.20.41.132", "172.253.115.94", "104.16.79.73", "172.253.122.95", "172.67.167.150" ], "asns": [ "16509", "13335", "15169" ], "countries": [ "US" ], "doc_hash": "826ab1d3d3fd3aa8e1041482026ea2f60c8743cc0fbc3152996257ebfcadddea", "script_hashes": [ "efd37bb0ed7fa1b6a6417ba3ee8a3ab51e18286727e4f45df9e70f5ed83466a9" ], "globals": [ "setSize", "draw", "showToast", "swTab", "fetchPrices", "calcStake", "setAmt", "setMax", "setDur", "nextDist", "doCalc", "addRow", "tFaq", "__cfBeacon", "cv", "ctx", "pts", "tt", "ondoPrice", "apyActive", "addrs", "actions", "amts", "fills", "wids", "io", "act", "secEls", "navAs" ], "cookies": [ "__ddg1_", "__ddg8_", "__ddg10_", "__ddg9_" ], "tls": { "san": [ "*.ondostaking.com", "ondostaking.com" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "ondostaking.com", "protocol": "QUIC", "valid_to": "2027-01-11T00:28:16Z", "valid_from": "2026-10-13T00:28:17Z" }, "domain_age_days": 7, "apex_age_days": 7, "tls_age_days": 9, "tls_valid_days": 89, "requests": 15, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 85, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html", "content-security-policy": "upgrade-insecure-requests;" } }, "cf": { "v": 1, "fetched_at": "2026-10-22T13:51:50Z", "uuid": "acd7873b-1799-424c-9882-9106dbe095fa", "scanned_at": "2026-10-22T13:48:53Z", "final_url": "https://ondostaking.com/", "status": 200, "history": [ { "url": "https://ondostaking.com/", "status": 200 } ], "dom_hash": "5eb3de34996fd988b2f0ac032c1edd84b029eaaf55319239dc56e78bfae8ab7f", "doc_hash": "826ab1d3d3fd3aa8e1041482026ea2f60c8743cc0fbc3152996257ebfcadddea", "phishing_v2": [ "phishing" ], "domain_risks": [ "Newly Seen Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "ondostaking.com", "type": "A", "value": "104.21.59.18" }, { "name": "ondostaking.com", "type": "A", "value": "172.67.167.150" }, { "name": "ondostaking.com", "type": "AAAA", "value": "2606:4700:3035::6815:3b12" }, { "name": "ondostaking.com", "type": "AAAA", "value": "2606:4700:3032::ac43:a796" } ], "dnssec_valid": false, "ip": "104.21.59.18", "whois": { "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com", "created": "2026-10-13T01:12:00Z", "updated": "2026-10-13T06:46:33Z", "expires": "2027-10-13T01:12:00Z", "nameservers": [ "kristina.ns.cloudflare.com", "thomas.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T13:48:30Z", "analysis_at": "2026-10-22T13:25:19Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com", "created": "2026-10-13T01:12:00Z", "expires": "2027-10-13T01:12:00Z", "updated": "2026-10-13T06:46:33Z", "first_seen": "2026-10-13T18:36:49Z", "dns": [ { "ttl": 300, "type": "A", "value": "172.67.167.150" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::ac43:a796" }, { "ttl": 300, "type": "A", "value": "104.21.59.18" }, { "ttl": 21600, "type": "NS", "value": "thomas.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "kristina.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "kristina.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::6815:3b12" } ], "dns_at": "2026-10-22T13:30:40Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.ondostaking.com", "ondostaking.com" ], "issuer": "Let's Encrypt / YE2", "serial": "6f3d25ee3af5fb697dc361c08402edd284c", "sha256": "821c37e401788b95f0766c6586046d55533e0207f846ced895e982ecb11b12d9", "subject": "ondostaking.com", "valid_to": "2027-01-11T00:28:16Z", "valid_from": "2026-10-13T00:28:17Z" }, "whois": { "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com", "registrar_iana_id": "49", "registrar_url": "https://internet.gmo/", "created": "2026-10-13T01:12:00Z", "updated": "2026-10-13T06:46:33Z", "expires": "2027-10-13T01:12:00Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "kristina.ns.cloudflare.com", "thomas.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2027-10-12T15:00:00Z", "last changed": "2026-10-13T06:46:33Z", "registration": "2026-10-12T16:12:01Z", "registrar expiration": "2027-10-12T15:00:00Z", "last update of RDAP database": "2026-10-22T13:30:39Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-22T13:52:12Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "ondostaking.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-22T13:17:01Z", "first": "2026-10-13T18:03:14Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.11, "avg_page_bytes": 24101 }, "social_tags": { "ogUrl": "https://ondostaking.com/", "title": "ONDO Staking — Stake ONDO Token on Ethereum", "ogType": "website", "robots": "index, follow, max-snippet:-1, max-image-preview:large", "ogImage": "https://ondostaking.com/og.png", "ogTitle": "ONDO Staking — Earn Yield on ONDO Token", "keywords": "ONDO staking, ONDO token stake, stake ONDO, ONDO Finance staking, ONDO Ethereum staking, ONDO yield, ONDO rewards, ondostaking.com, ONDO DeFi, ONDO crypto staking, ONDO APY, ONDO passive income, ONDO liquid staking, ONDO governance staking, best ONDO staking 2024", "ogSiteName": "ONDO Staking", "description": "Stake ONDO tokens on Ethereum and earn protocol rewards. ONDO staking on ondostaking.com — the leading ONDO Finance staking platform. Non-custodial, audited, earn yield on your ONDO tokens today.", "twitterCard": "summary_large_image", "canonicalUrl": "https://ondostaking.com/", "ogDescription": "Stake ONDO on Ethereum and earn protocol rewards. Non-custodial. No minimum. ondostaking.com" }, "trackers": { "requests": 12, "trackers": [ { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 } ] }, "mixed_content": { "upgrade_insecure": true, "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 27, "tls": 25, "wait": 302, "connect": 9, "download": 6 }, "response_ms": 369 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 95629, "co2_grams": 0.0035, "cleaner_than": 23 }, "dns_server": { "ns": [ { "ip": "172.64.33.238", "host": "thomas.ns.cloudflare.com" }, { "ip": "162.159.38.125", "host": "kristina.ns.cloudflare.com" } ], "zone": "ondostaking.com" }, "cookies": { "cookies": [ { "name": "__ddg1_", "http_only": true }, { "name": "__ddg10_" }, { "name": "__ddg8_" }, { "name": "__ddg9_" } ] }, "location": { "ip": "2606:4700:3032::ac43:a796", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "ondostaking.com" }, "dns": { "A": [ "172.67.167.150", "104.21.59.18" ], "NS": [ "kristina.ns.cloudflare.com", "thomas.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"kristina.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417471383, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3035::6815:3b12", "2606:4700:3032::ac43:a796" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": "upgrade-insecure-requests;", "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3035::6815:3b12", "family": 6 }, "redirects": { "chain": [ "https://ondostaking.com" ] }, "linked_pages": { "internal_count": 8 }, "whois": { "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com", "created": "2026-10-13T01:12:00Z", "updated": "2026-10-13T06:46:33Z", "expires": "2027-10-13T01:12:00Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "kristina.ns.cloudflare.com", "thomas.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html", "content-security-policy": "upgrade-insecure-requests;" } } } } ```