xn--ornado-2kb[.]cash

This domain, ornado.cash, is identified as a credential harvesting phishing site targeting users through a deceptive "Service Status" page. Analysis indicates the infrastructure is designed to mimic legitimate service status portals, tricking visitors into submitting sensitive login credentials under the pretense of account verification or system maintenance. The page title "Service Status" suggests an attempt to impersonate technical support or cloud service providers, a common tactic in phishing campaigns to exploit user trust in system alerts. Infrastructure analysis reveals the domain was registered on June 20, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, which has been observed in prior malicious activity. Detection metrics show 2 out of 95 security vendors on VirusTotal flag the domain as malicious, while AlienVault OTX records it in one threat intelligence pulse. The domain remains active, utilizing a Let's Encrypt SSL certificate to present a false sense of legitimacy. Users who have visited ornado.cash should immediately revoke any credentials entered on the site, particularly if they pertain to corporate or financial accounts. System administrators are advised to block the domain and its resolving IP (188.114.96.3) at the network level. Affected individuals should monitor accounts for unauthorized activity and enable multi-factor authentication where available. Given the domain's recent creation and low detection rate, heightened vigilance is recommended for similar "Service Status" themed phishing attempts.