ondemind-rewards[.]de

The domain ondemind-rewards.de was registered on May 12, 2026 and is currently active. Threat intelligence assigns it a high risk rating and classifies it as a generic phishing operation. The site returns HTTP 200 responses and is hosted behind Cloudflare, using the nameservers brenna.ns.cloudflare.com and ken.ns.cloudflare.com. Technical analysis shows the site resolves to IP 188.114.97.3, a Cloudflare edge node located in Canada. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS connection. VirusTotal scans have flagged the domain by three out of ninety‑five security vendors, and Gridinsoft assigns a trust score of zero out of one hundred. The page title, “ONDEMIND Rewards – Reward-Apps & Umfrage-Apps ehrlich getestet,” suggests a deceptive reward‑app survey lure. The domain appears on three public blocklists and is actively blocked by multiple anti‑phishing feeds, including PhishDestroy, MetaMask, and SEAL. While the content has not been captured in a full page scrape, the combination of a recent registration, low trust score, multiple vendor detections, and the reward‑app phrasing strongly indicates a credential‑harvesting front‑end. No additional infrastructure such as command‑and‑control servers or malware payloads has been identified to date. Defenders should add ondemind-rewards.de to URL filtering and DNS sinkhole policies, and block the associated IP address 188.114.97.3 at the network perimeter. Continuous monitoring of Cloudflare edge IP ranges for similar newly‑registered domains is advised. End‑user awareness training should highlight the “reward‑app” narrative as a common lure used in credential‑phishing campaigns.