join-ondo[.]finance

join-ondo.finance is currently listed as offline. The domain was registered on 23 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (AS13335) under the IP address 104.21.6.46, which resolves to a United States location. DNS resolution uses the Cloudflare authorative nameservers marty.ns.cloudflare.com and kiki.ns.cloudflare.com. The site presented the page title “Just a moment…”, which is the only visible content captured. The SSL certificate presented is issued by Google Trust Services under the WE1 designation, indicating a valid TLS configuration.

Automated analysis detected Cloudflare Browser Insights, Cloudflare services, and HTTP/3 protocol support. VirusTotal scans returned four positive detections out of ninety‑three security vendors, confirming that multiple scanners flagged the domain as malicious. The domain also appears on three external blocklists, and it has been blocked by commercial anti‑phishing solutions including PhishDestroy, MetaMask, and SEAL. No further public intelligence such as Safe Browsing or OTX identifiers is available for this domain.

The combination of a recent registration date, Cloudflare‑based hosting, a legitimate‑looking Google‑issued certificate, and multiple vendor detections suggests the domain was employed for a generic phishing campaign. However, the specific target or payload details remain unknown because the page content has not been disclosed beyond the generic title. Defenders should continue to block the domain at network perimeter and endpoint layers, monitor DNS queries for the associated IP address and nameservers, and consider adding the domain to internal blocklists. Ongoing threat‑intel feeds should be queried for any emerging indicators of compromise linked to join-ondo.finance, and any future re‑activation should be re‑evaluated with full content analysis.