multiplier-ondo[.]info

This domain, multiplier-ondo.info, is actively engaged in phishing operations targeting cryptocurrency users by impersonating Ondo Finance, a legitimate tokenized asset protocol. Analysis indicates the site presents a fraudulent token claim portal, designed to harvest wallet credentials and private keys under the guise of a legitimate airdrop or token distribution event. The infrastructure mimics official Ondo Finance branding, including logos, color schemes, and transaction workflows, to deceive users into connecting their cryptocurrency wallets to malicious smart contracts. Infrastructure analysis reveals the domain was registered on June 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to IP address 172.67.222.190 and is currently flagged by 5 out of 95 security vendors on VirusTotal, indicating detection by multiple threat intelligence platforms. Additionally, the domain appears on two independent security blocklists, and its SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to unsuspecting users. The domain has also been identified in one threat intelligence pulse on AlienVault OTX, further corroborating its malicious intent. Users who have visited multiplier-ondo.info or interacted with its content should immediately revoke any connected wallet permissions and transfer assets to a new, secure wallet address. It is critical to monitor transaction histories for unauthorized activity and report any suspicious transactions to the relevant blockchain explorer or security platform. No further interaction with the domain should occur, and users are advised to verify all token claim events through official channels only. Security teams should update blocklists to include this domain and its associated IP address to prevent further exposure within their networks.