# PhishDestroy domain threat record: try-ondrela.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/try-ondrela.com/ Machine-readable companion: https://phishdestroy.io/domain/try-ondrela.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-28 07:45:27 UTC - Last availability or vendor check: 2026-10-28 12:30:58 UTC - Stored record updated: 2026-10-28 12:30:58 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 104.18.28.91 - Registrar in stored WHOIS data: GoDaddy.com, LLC - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-06-09 04:20:06 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a18177-bdff-72e9-a149-248f1b1e1fd8/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/try-ondrela.com - Certificate Transparency search: https://crt.sh/?q=%25.try-ondrela.com - Web Archive lookup: https://web.archive.org/web/*/https://try-ondrela.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI gave a strong phishing confidence of 90% and flagged the domain because it uses the Ondrela brand and offers a 70% discount on a “golden card”, a pattern common to fake‑store scams. The prior assessment also highlighted that the domain is not the official Ondrela site. The page was first seen by PhishDestroy on 2026-10-28 and returned an HTTP 200 response at that time. How the scam works Fake‑store scams impersonate a known brand, display deep‑discount offers and a polished checkout flow to lure victims into providing payment details or personal data. The promised product is never delivered, and the operator profits from the fraudulent transaction or harvested information. Evidence VirusTotal recorded one suspicious detection from alphaMountain.ai out of 92 engines on 2026-10-28, with no malicious verdicts. Google Safe Browsing did not flag the domain on the same date. URLScan’s machine‑learning engine assigned a high malicious score (96) but its overall verdict was non‑malicious; the scan captured the page title “Ondrela — Everyone Sees a Gold Card. It's a Tracker.” and the excerpt “Saat -70 % alennuksen”. PhishDestroy’s internal blocklist marks the domain as malicious, and OTX lists four pulses referencing the domain. Infrastructure The domain was registered on 2026-06-09 through GoDaddy.com, LLC, giving it an age of 141 days at first sighting. The recorded DNS returned Cloudflare A records 104.18.28.91 and 104.18.29.91 and AAAA records 2606:4700::6812:1c5b and 2606:4700::6812:1d5b. The TLS certificate captured on 2026-10-28 was issued by Google Trust Services and was valid until 2027-01-03. No DNSSEC signatures were observed and external blocklists reported no hits. What to do Visitors should avoid entering any personal, payment or login information on the site and close the page immediately. If credentials were submitted, change the associated passwords and monitor accounts for unauthorized activity. Defenders should block try-ondrela.com at the network perimeter, log any connections to its IP addresses, and keep the domain on threat‑intelligence feeds. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a18177-bdff-72e9-a149-248f1b1e1fd8/ Cloudflare Radar report: https://radar.cloudflare.com/scan/d8203ee2-f4c6-436b-9f64-3b376a2c54d2 URLQuery report: https://urlquery.net/report/207b4b70-cbf3-4df3-9dcb-718a87573595 Stored capture screenshot: https://i.ibb.co/4kw250g/e12a413301ba.png Cloudflare Radar screenshot (2026-10-28T08:16:49Z): https://screenshots.phishdestroy.io/cf/d8203ee2-f4c6-436b-9f64-3b376a2c54d2.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/207b4b70-cbf3-4df3-9dcb-718a87573595.png URLScan screenshot (2026-07-17T15:01:59Z): https://screenshots.phishdestroy.io/us/019f7099-2352-75be-9df3-8b55c76ed89b.png URLScan capture report: https://urlscan.io/result/019f7099-2352-75be-9df3-8b55c76ed89b/ URLScan screenshot (2026-09-29T12:07:58Z): https://screenshots.phishdestroy.io/us/01a0ed10-60fe-707f-82f7-04c5bc9f93bc.png URLScan capture report: https://urlscan.io/result/01a0ed10-60fe-707f-82f7-04c5bc9f93bc/ URLScan screenshot (2026-10-06T04:58:59Z): https://screenshots.phishdestroy.io/us/01a10f94-2ebb-704c-944b-880ac4136e2e.png URLScan capture report: https://urlscan.io/result/01a10f94-2ebb-704c-944b-880ac4136e2e/ URLScan screenshot (2026-10-06T13:13:00Z): https://screenshots.phishdestroy.io/us/01a11158-7107-70e0-ad31-0bc37a619b06.png URLScan capture report: https://urlscan.io/result/01a11158-7107-70e0-ad31-0bc37a619b06/ URLScan screenshot (2026-10-12T10:22:23Z): https://screenshots.phishdestroy.io/us/01a12fa2-66ab-7176-8e89-ec3265779bab.png URLScan capture report: https://urlscan.io/result/01a12fa2-66ab-7176-8e89-ec3265779bab/ URLScan screenshot (2026-10-21T12:39:21Z): https://screenshots.phishdestroy.io/us/01a15e79-0d6f-7290-8d1d-a0ec7bd1f18b.png URLScan capture report: https://urlscan.io/result/01a15e79-0d6f-7290-8d1d-a0ec7bd1f18b/ VirusTotal report: https://www.virustotal.com/gui/domain/try-ondrela.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=try-ondrela.com Archived copy: https://web.archive.org/web/20261028074503/https://try-ondrela.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-28 10:49:44 UTC ## Stored page captures - Primary capture: https://i.ibb.co/4kw250g/e12a413301ba.png Captured: 2026-10-28 07:45:27 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a18177-bdff-72e9-a149-248f1b1e1fd8.png Captured: 2026-10-28 07:45:27 UTC Source report: https://urlscan.io/result/01a18177-bdff-72e9-a149-248f1b1e1fd8/ - URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15e79-0d6f-7290-8d1d-a0ec7bd1f18b.png Captured: 2026-10-21 12:39:21 UTC Source report: https://urlscan.io/result/01a15e79-0d6f-7290-8d1d-a0ec7bd1f18b/ SHA-256: 8b8aed75beafbda14eca850e88233cd0f6ee8d09d5a21fdd503fb4ce8fcc33bf - URLScan · 2026-07-17: https://screenshots.phishdestroy.io/us/019f7099-2352-75be-9df3-8b55c76ed89b.png Captured: 2026-07-17 15:01:59 UTC Source report: https://urlscan.io/result/019f7099-2352-75be-9df3-8b55c76ed89b/ SHA-256: fa8927d8dbc0271ad8de1f030719ffebdffde8db8d80cff91f97a48209cb78e0 - URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0ed10-60fe-707f-82f7-04c5bc9f93bc.png Captured: 2026-09-29 12:07:58 UTC Source report: https://urlscan.io/result/01a0ed10-60fe-707f-82f7-04c5bc9f93bc/ SHA-256: 8557271810be874567120d59281c9f4e820b8c4ec14dd595eeb230d15bc6e02c - URLScan · 2026-10-06: https://screenshots.phishdestroy.io/us/01a10f94-2ebb-704c-944b-880ac4136e2e.png Captured: 2026-10-06 04:58:59 UTC Source report: https://urlscan.io/result/01a10f94-2ebb-704c-944b-880ac4136e2e/ SHA-256: 983876e7b47a17908262fe4b4753dad16c7bd517ecc45f6486c038b03e961c21 - URLScan · 2026-10-06: https://screenshots.phishdestroy.io/us/01a11158-7107-70e0-ad31-0bc37a619b06.png Captured: 2026-10-06 13:13:00 UTC Source report: https://urlscan.io/result/01a11158-7107-70e0-ad31-0bc37a619b06/ SHA-256: da82c94d57826311e619ae900745563c76195c8d898a77f30ef0a733a55f4c12 - URLScan · 2026-10-12: https://screenshots.phishdestroy.io/us/01a12fa2-66ab-7176-8e89-ec3265779bab.png Captured: 2026-10-12 10:22:23 UTC Source report: https://urlscan.io/result/01a12fa2-66ab-7176-8e89-ec3265779bab/ SHA-256: 301d85a5b78145836ced37b51c8b04be56b765c5383133df7f5e2c61138551c6 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d8203ee2-f4c6-436b-9f64-3b376a2c54d2.png Captured: 2026-10-28 08:16:49 UTC Source report: https://radar.cloudflare.com/scan/d8203ee2-f4c6-436b-9f64-3b376a2c54d2 SHA-256: 74764011879992a524cc6d211a03499b4c5af6eafb72de460cf760308aa40b5e - URLQuery: https://screenshots.phishdestroy.io/uq/207b4b70-cbf3-4df3-9dcb-718a87573595.png Source report: https://urlquery.net/report/207b4b70-cbf3-4df3-9dcb-718a87573595 SHA-256: 00a898c8315a3bdc835710edcb948df1415f4803b18c9b89e1995b7efc911cb1 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-28T08:17:05Z", "uuid": "01a18177-bdff-72e9-a149-248f1b1e1fd8", "scanned_at": "2026-10-28T07:44:37Z", "final_url": "https://try-ondrela.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://try-ondrela.com/", "from": "http://try-ondrela.com/", "status": 307 } ], "ip": "2606:4700::6812:1d5b", "domains": [ "assets.fnel.ai", "api.octocom.ai", "connect.facebook.net", "chat.octocom.ai", "www.octocom.ai", "region1.google-analytics.com", "www.googletagmanager.com", "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "2001:4860:4802:32::36", "2606:4700:20::681a:7a9", "192.178.183.94", "157.240.0.6", "2606:4700:20::ac43:4aaf", "2a00:1450:4001:c0f::61", "188.114.96.3", "2a00:1450:4001:c25::5f", "2606:4700::6812:1d5b" ], "asns": [ "15169", "13335", "32934" ], "countries": [ "US", "DE" ], "link_domains": [ "ondrela.com" ], "doc_hash": "ec0bf4c37430a319c63e7acbcdcd6db515a346797e282c705c1a29e8c6103da2", "script_hashes": [ "404089f401422b241b670bf3fdbc5851e23a4606c698b899906976785055ebbe" ], "globals": [ "cookieBannerEnabled", "loadScriptWithConsent", "dispatchToTracktor", "cookieBannerEvents", "trackBannerEvent", "orbServerData", "orbSessionData", "gtmLayer", "brandGtmLayer", "fbq", "_fbq", "trackMetaEventOncePerSession", "gatag", "gaLayer", "setConsentMode", "eventParameters", "userProperties", "forwardAiFunnelEmails", "CookieConsentBanner", "cookieBanner", "__octocomLoaderStarted", "google_tag_data", "google_tag_manager", "gaGlobal", "onYouTubeIframeAPIReady", "__defProp", "__typeError", "__defNormalProp", "__publicField", "__accessCheck", "__privateGet", "__privateAdd", "__privateSet", "__privateMethod", "__privateWrapper", "__zod_globalConfig", "__zod_globalRegistry", "octocomSearch", "hb", "mm" ], "cookies": [ "rpp", "srpp_ad9209ba", "orbio_session_id", "XSRF-TOKEN", "enence_session", "_fbp" ], "storage_keys": [ "fb-903090581609834-ViewContent-01a18177-bfec-7848-9eb2-e7cc8e8b4e48", "fb-1662731964804994-ViewContent-01a18177-bfec-7848-9eb2-e7cc8e8b4e48", "__test__", "cookie-banner-shown", "consentMode", "lastExternalReferrer", "lastExternalReferrerTime", "octocom-search-session" ], "tls": { "san": [ "try-ondrela.com", "*.try-ondrela.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "try-ondrela.com", "protocol": "TLS 1.3", "valid_to": "2027-01-03T10:44:54Z", "valid_from": "2026-10-05T09:44:57Z" }, "domain_age_days": 139, "apex_age_days": 139, "tls_age_days": 22, "tls_valid_days": 90, "requests": 44, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 96, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-28T08:17:10Z", "uuid": "d8203ee2-f4c6-436b-9f64-3b376a2c54d2", "scanned_at": "2026-10-28T08:16:49Z", "final_url": "https://try-ondrela.com/", "status": 200, "history": [ { "url": "https://try-ondrela.com/", "status": 200 } ], "dom_hash": "c33f224819323fa99b09845c412c6bafb8d5f838e7e4237f7ea236a46e87fa68", "doc_hash": "4c25c6c4872e5a5067461f50c68516dba91560c0a0460fe19c717ab95c57ffb2", "domain_risks": [ "Ecommerce", "Shopping & Auctions" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "try-ondrela.com", "type": "A", "value": "104.18.29.91" }, { "name": "try-ondrela.com", "type": "A", "value": "104.18.28.91" }, { "name": "try-ondrela.com", "type": "AAAA", "value": "2606:4700::6812:1c5b" }, { "name": "try-ondrela.com", "type": "AAAA", "value": "2606:4700::6812:1d5b" } ], "dnssec_valid": false, "ip": "127.0.1.4", "whois": { "registrar": "GoDaddy.com, LLC", "created": "2026-06-09T06:20:06Z", "updated": "2026-06-16T02:58:29Z", "expires": "2029-06-09T06:20:06Z", "nameservers": [ "seth.ns.cloudflare.com", "tani.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-28T10:49:20Z", "analysis_at": "2026-10-28T08:40:24Z", "stats": { "timeout": 0, "harmless": 56, "malicious": 0, "suspicious": 1, "undetected": 35 }, "detections": { "alphaMountain.ai": "suspicious" }, "reputation": 0, "registrar": "GoDaddy.com, LLC", "created": "2026-06-09T06:20:06Z", "expires": "2029-06-09T06:20:06Z", "updated": "2026-06-16T02:58:29Z", "first_seen": "2026-06-09T07:51:48Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700::6812:1d5b" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700::6812:1c5b" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "seth.ns.cloudflare.com" }, { "ttl": 300, "type": "MX", "value": "smtp.google.com", "priority": 1 }, { "ttl": 300, "type": "A", "value": "104.18.29.91" }, { "ttl": 21600, "type": "NS", "value": "tani.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=iV3KM3fwFikPIPx3grdDMlsTsc74GMQUJLKGV2APzWM" }, { "ttl": 300, "type": "A", "value": "104.18.28.91" }, { "ttl": 21600, "type": "NS", "value": "seth.ns.cloudflare.com" } ], "dns_at": "2026-10-28T08:45:59Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "try-ondrela.com", "*.try-ondrela.com" ], "issuer": "Google Trust Services / WE1", "serial": "b6fec9d8d8e0f7181347c79ace8ccc5f", "sha256": "df3715fb2d58fae834631eef1b627d8f1a41ae33da1b9a441769320343b2e455", "subject": "try-ondrela.com", "valid_to": "2027-01-03T10:44:54Z", "valid_from": "2026-10-05T09:44:57Z" }, "whois": { "registrar": "GoDaddy.com, LLC", "registrar_iana_id": "146", "registrar_url": "http://www.godaddy.com", "created": "2026-06-09T06:20:06Z", "updated": "2026-06-16T02:58:29Z", "expires": "2029-06-09T06:20:06Z", "status": [ "clientDeleteProhibited", "clientRenewProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "seth.ns.cloudflare.com", "tani.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client delete prohibited", "client renew prohibited", "client transfer prohibited", "client update prohibited" ], "events": { "expiration": "2029-06-09T06:20:06Z", "last changed": "2026-06-16T02:58:29Z", "registration": "2026-06-09T06:20:06Z", "last update of RDAP database": "2026-10-22T07:21:35Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-28T07:55:36Z", "mail_config": { "mx": [ "smtp.google.com" ], "providers": [ "Google Workspace" ], "spf_lookups": 0 }, "caa_records": { "domain": "try-ondrela.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-28T07:45:03Z", "first": "2026-07-17T23:47:02Z", "changes": 4, "days_archived": 5, "scans_per_day": 0.04, "avg_page_bytes": 16901 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://try-ondrela.com/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 25 }, "social_tags": { "title": "Ondrela — Everyone Sees a Gold Card. It's a Tracker.", "robots": "noindex, nofollow", "canonicalUrl": "https://ondrela.com/" }, "trackers": { "requests": 30, "trackers": [ { "name": "Facebook", "company": "Meta", "country": "US", "category": "Advertising", "requests": 2 }, { "name": "Google Tag", "company": "Google", "country": "US", "category": "Advertising", "requests": 2 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Facebook Connect", "company": "Meta", "country": "US", "category": "Site Analytics", "requests": 2 }, { "name": "Google Analytics", "company": "Google", "country": "US", "category": "Site Analytics", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://www.googletagmanager.com/gtag/js", "https://www.octocom.ai/chatbot/bundle.js" ], "third_party_scripts": 2 }, "status": { "up": true, "code": 200, "timings": { "dns": 1, "tls": 34, "wait": 480, "connect": 6, "download": 0 }, "response_ms": 521 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 53922, "co2_grams": 0.002, "cleaner_than": 35 }, "dns_server": { "ns": [ { "ip": "173.245.59.142", "host": "seth.ns.cloudflare.com" }, { "ip": "172.64.32.224", "host": "tani.ns.cloudflare.com" } ], "zone": "try-ondrela.com" }, "cookies": { "cookies": [ { "name": "rpp", "secure": true, "same_site": "Lax" }, { "name": "srpp_96c408bb", "secure": true, "http_only": true, "same_site": "Lax" }, { "name": "orbio_session_id", "same_site": "Lax" }, { "name": "XSRF-TOKEN", "secure": true, "same_site": "Lax" }, { "name": "enence_session", "secure": true, "http_only": true, "same_site": "Lax" }, { "name": "_fbp", "same_site": "Lax" } ] }, "location": { "ip": "2606:4700::6812:1d5b", "asn": "13335", "org": "Cloudflare, Inc.", "city": "San Francisco", "country": "US" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "try-ondrela.com" }, "dns": { "A": [ "104.18.28.91", "104.18.29.91" ], "MX": [ "{\"exchange\": \"smtp.google.com\", \"priority\": 1}" ], "NS": [ "tani.ns.cloudflare.com", "seth.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"seth.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417986978, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "google-site-verification=iV3KM3fwFikPIPx3grdDMlsTsc74GMQUJLKGV2APzWM" ], "AAAA": [ "2606:4700::6812:1d5b", "2606:4700::6812:1c5b" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=63072000; includeSubDomains; preload", "message": "Site is compatible with the HSTS preload list!", "compatible": true }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700::6812:1c5b", "family": 6 }, "redirects": { "chain": [ "https://try-ondrela.com" ] }, "rank": { "domain": "try-ondrela.com" }, "tech_stack": { "technologies": [ "Cart Functionality", "Google Cloud", "Google Analytics", "Facebook Pixel", "core-js", "Priority Hints", "Google Font API", "HSTS", "Google Cloud Trace", "Google Cloud CDN", "Cloudflare" ] }, "linked_pages": { "external": [ "https://ondrela.com/ondrela/about-us" ], "external_count": 1, "internal_count": 12 }, "whois": { "registrar": "GoDaddy.com, LLC", "created": "2026-06-09T06:20:06Z", "updated": "2026-06-16T02:58:29Z", "expires": "2029-06-09T06:20:06Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientRenewProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp", "clientUpdateProhibited https://icann.org/epp" ], "nameservers": [ "seth.ns.cloudflare.com", "tani.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "x-content-type-options": "nosniff" } } } } ```