ondotoken[.]live

Analysis of ondotoken.live, observed on July 23, 2026, indicates that the domain was created on July 03, 2026 and is currently offline. The site was hosted on IP 216.198.79.65, which resolves to an Amazon.com, Inc. AS16509 infrastructure located in the United States. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED and the authoritative nameservers are mckenzie.ns.cloudflare.com and seth.ns.cloudflare.com. No TLS certificate was presented, implying HTTP‑only delivery.

The page title retrieved during the brief observation read “Ondo Finance — Claim $ODF”, and the campaign was classified as brand impersonation targeting the cryptocurrency exchange OKX. Threat intelligence sources confirm that the domain appears on three blocklists, including PhishDestroy, MetaMask, and SEAL, and it has been referenced in a single AlienVault OTX pulse. VirusTotal scans reported four positive detections out of ninety‑one security vendors, and Gridinsoft assigned a trust score of zero out of one hundred. The combination of a newly registered domain, lack of encryption, use of reputable cloud nameservers, and hosting on a shared Amazon cloud IP is consistent with rapid‑deployment phishing infrastructure.

While the site is no longer reachable, defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for future activity, and add the domain to internal watchlists. Additional verification of any emails or messages that reference “Ondo Finance” or claim $ODF should be performed, and users should be reminded that legitimate communications from OKX will never request token claims in this manner. Continued observation of the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED may reveal further related registrations.