register-ondo[.]finance

This domain, register-ondo.finance, was registered on May 30, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently flagged as a high-risk crypto scam. Analysis indicates the domain resolves to 188.114.96.3, an IP address hosted on AS13335 (Cloudflare, Inc.) in the United States. The infrastructure is protected by Cloudflare, with nameservers adam.ns.cloudflare.com and danica.ns.cloudflare.com, and supports HTTP/3. A Let's Encrypt SSL certificate (YE2) is present, suggesting an attempt to appear legitimate, though the domain returns an HTTP 403 status, which may indicate restricted access or defensive measures against automated analysis. Security vendors have detected malicious activity: six of the 91 engines on VirusTotal flag the domain, and it appears on three security blocklists, including PhishDestroy, ScamSniffer, and Enkrypt. The page title, 'Nur einen Moment…', is consistent with temporary holding or redirection pages often used in phishing campaigns to evade detection. The scam type is classified as a crypto scam, though the exact mechanics—whether a drainer, fake exchange, or investment fraud—remain unconfirmed due to limited visibility into the site's content. Defenders should treat this domain as active and high-risk. The use of Cloudflare complicates takedown efforts and may obscure the true hosting origin. Network-level blocking of the IP 188.114.96.3 and monitoring for connections to the domain are recommended. Given the domain's recent registration and association with known phishing infrastructure, organizations should prioritize alerting users to avoid interaction with register-ondo.finance or any subdomains.