intl-onchain[.]net

This domain, intl-onchain.net, is identified as part of a phishing campaign targeting users through fraudulent AI Smart Contract interfaces. The site mimics legitimate smart contract platforms, likely aiming to harvest cryptocurrency wallet credentials, private keys, or other sensitive financial data. Users encountering this domain may be lured into interacting with malicious smart contracts or entering recovery phrases under the guise of AI-driven automation, leading to unauthorized asset transfers or account takeovers. Analysis indicates the domain was registered on March 10, 2026, through NameSilo, LLC, a registrar frequently observed in phishing infrastructure. It resolves to the IP address 172.67.172.231 and is proxied by Cloudflare, a common tactic to obscure hosting origins and evade takedowns. Detection engines flagged the domain with 6 out of 95 security vendors on VirusTotal, while it appears on two independent security blocklists. The use of HTTP/3 further suggests an attempt to leverage modern web protocols to bypass traditional security filters. If this domain was visited, immediate action is required. Users should disconnect any connected wallets or devices from the internet and revoke all active smart contract permissions associated with the affected wallet. A full security audit of the wallet and connected applications is recommended, including scanning for unauthorized transactions. Passwords, recovery phrases, or private keys entered on the site should be considered compromised and rotated immediately. Monitoring for unusual activity on linked accounts is advised for at least 30 days following exposure.