access-ondo[.]com

Analysis of access-ondo.com indicates active phishing infrastructure designed to harvest credentials or facilitate unauthorized access. The domain, registered on February 21, 2026, through NiceNIC International Group Co., Limited, currently resolves to 188.114.97.3, an IP address assigned to Cloudflare, Inc. (AS13335) in the United States. Nameservers lochlan.ns.cloudflare.com and ruth.ns.cloudflare.com further confirm Cloudflare’s role in hosting the infrastructure, while detected technologies include Cloudflare Browser Insights, Cloudflare CDN, and HTTP/3, suggesting optimized delivery of malicious content. The domain is flagged by 2 of 93 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy.

Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. The site returns an HTTP 403 status, typically indicating a forbidden access response, while the page title 'Just a moment...' aligns with Cloudflare’s interstitial challenge pages, often used to filter or delay access to malicious content. The SSL certificate, issued by Google Trust Services (WE1), provides no inherent indication of legitimacy, as phishing sites frequently leverage valid certificates to appear credible.

While the exact target or phishing kit remains unconfirmed due to limited public analysis, the combination of Cloudflare hosting, low detection but confirmed blocklisting, and the HTTP 403 response suggests an evasion tactic to obscure malicious activity from automated scanners. Defenders should treat this domain as active phishing infrastructure, block resolution at the DNS level, and monitor associated IPs for additional malicious domains. Further investigation is required to determine the specific brand or service being impersonated, as no conclusive evidence is currently available in the observable data.