access-ondo[.]finance

access-ondo.finance is currently flagged as a high‑risk generic phishing site. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 188.114.97.3 (AS13335, United States). DNS resolution uses the Cloudflare nameservers lara.ns.cloudflare.com and otto.ns.cloudflare.com, and the site is served over HTTPS with a Google Trust Services / WE1 certificate. An HTTP request returns a 403 status code, and the only visible page element is the title “Even geduld…”, which provides no further context about the payload.

Cloudflare Browser Insights and HTTP/3 are detected, indicating the use of Cloudflare’s performance services. Reputation checks show a Gridinsoft trust score of 0 / 100 and the domain appears on one security blocklist, specifically PhishDestroy, which has already blocked it. VirusTotal analysis reports four detections out of ninety‑three scanning engines, confirming malicious activity. No additional intelligence such as Safe Browsing alerts, OTX references, or known phishing kits is presently available.

Given the combination of a recent registration, low trust score, blocklist presence, and multiple vendor detections, defenders should treat the domain as hostile. Recommended mitigations include adding the domain to DNS and URL filtering policies, monitoring for any traffic to the associated IP address, and employing endpoint protection that references VirusTotal signatures. Continuous re‑evaluation is advised as further content analysis may reveal additional indicators of compromise.