sso.onrc.ro presents itself as a Keycloak administration console, a tool designed to centrally manage user authentication and access. That alone should make you stop and think: would you hand the keys to your login system to a person you cannot identify?
The biggest red flag here is the complete lack of transparency. The WHOIS record hides every detail about the domain owner. There is no about page, no contact form, no email address, and no phone number. Legitimate SaaS providers, especially ones handling authentication, typically put their company name, location, and contact details front and center. This site does the opposite.
Security headers are configured well, so the technical setup isn't sloppy. But good encryption means little when you don't know who is on the other end. The robots.txt file also blocks search engines entirely, which is unusual for a genuine service — it's a tactic used by sites that do not want scrutiny.
If you found a link to sso.onrc.ro in an email or on a forum asking you to log in, treat it with extreme caution. A legitimate Keycloak deployment would have documentation, community links, and some way to reach the administrators. This site has none of those. For now, the safest move is to stay away.