ondo[.]foundation-point[.]cyou

The domain ondo.foundation-point.cyou is currently listed as a high‑risk generic phishing site employing an NFT‑related scam. It was registered on 2025‑11‑06 through Web Commerce Communications Limited and is hosted on Cloudflare infrastructure, resolving to IP address 188.114.97.3. The live page returns HTTP 200 and presents the title “Security Verification – $ONDO”, indicating an attempt to lure victims into a verification flow. Infrastructure analysis shows the site uses Cloudflare services, including Browser Insights and HTTP/3, and is served with an SSL certificate issued by Google Trust Services under the “WE1” designation. The hosting IP is located in the United States and belongs to AS13335 (Cloudflare, Inc.). The domain appears on one public security blocklist and has a Gridinsoft trust score of 0 / 100. VirusTotal reports three positive detections out of ninety‑five scanners. Publicly available evidence is limited to the page title and hosting metadata; no additional content or credential‑capture mechanisms have been captured. Consequently, the exact phishing lures, payloads, or victim interaction patterns remain unverified. The classification as an “NFT Scam” derives from the provided intelligence, but the site’s specific tactics—such as fake wallet prompts or token transfer requests—have not been observed. Defenders should immediately block ondo.foundation-point.cyou at DNS resolvers, firewalls, and email security gateways. Monitoring network traffic for connections to 188.114.97.3 can help detect attempted accesses. The domain should be added to internal blocklists and shared with external threat‑intelligence feeds. User awareness training should emphasize the risk of unsolicited NFT verification requests and advise verification only through official channels.