ondofinance[.]tech

This domain, ondofinance.tech, carries an elevated risk level due to its confirmed brand impersonation of Lido, a popular liquid staking protocol. PhishDestroy identified this threat as a sophisticated phishing attempt designed to deceive users into revealing sensitive information or connecting their wallets to a malicious interface. The site was taken offline, but its infrastructure remains a concern for future campaigns.

Technical indicators paint a clear picture of malicious intent. VirusTotal flagged the domain with 14 out of 95 security vendors marking it as dangerous. The domain was registered through NameCheap, Inc. on June 13, 2026, and resolves to IP address 192.64.119.162. It appears on one security blocklist, and AlienVault OTX found it included in four threat intelligence pulses. Notably, the SSL certificate is absent, which is unusual for any legitimate financial service. The page title displayed "Ondo Finance," a deliberate attempt to confuse users by mimicking a legitimate DeFi brand while actually targeting Lido customers.

Users who may have encountered this site should immediately avoid entering any credentials or connecting their wallets. If any information was submitted, they should revoke wallet permissions, enable two-factor authentication on all accounts, and monitor for unauthorized transactions. PhishDestroy recommends reporting the domain to NameCheap and other registrar abuse contacts to prevent re-registration. Staying vigilant against brand impersonation and verifying URLs through official channels remains the best defense against such threats.