ondofi-votes[.]com

This domain, ondofi-votes.com, is actively engaged in a crypto-focused credential theft campaign impersonating Ondo Finance governance portals. Analysis of the page title, "OIP-23: Q2 2026 Ecosystem Rewards — Ondo Governance," reveals an attempt to deceive users into believing they are interacting with a legitimate Ondo Improvement Proposal (OIP) for token rewards distribution. The site likely harvests wallet credentials or private keys under the guise of claiming ecosystem incentives, a common tactic in crypto drainer schemes targeting decentralized finance (DeFi) participants. Infrastructure analysis reveals the domain was registered on May 25, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, with resolution to IPv6 address 2a06:98c1:3121::3, hosted on Cloudflare’s network (AS13335). Security vendor detection on VirusTotal stands at 3/95, while the domain appears on four independent blocklists, including those maintained by browser-based transaction scanners and wallet security platforms. The SSL certificate, issued by Let’s Encrypt (serial E7), provides encrypted connections but does not validate legitimacy. No Google Safe Browsing (GSB) flags were observed at the time of analysis, though this may reflect detection latency rather than absence of malicious intent. The domain remains active as of this report, with confirmed blocking by at least four security layers, including transaction simulators and wallet integrity monitors. The remaining risk is classified as high due to the targeted nature of the campaign, the use of a trusted brand, and the potential for credential exfiltration leading to asset compromise. Users are advised to verify governance portals exclusively through official Ondo Finance channels, enable hardware wallet protections for high-value transactions, and cross-reference domain registration dates with known legitimate campaign timelines. Network-level blocking of the resolved IP and domain is recommended for enterprise environments handling crypto assets.