international-help[.]info

The domain international-help.info has been identified as a phishing site specializing in fraudulent legal recovery schemes. Analysis classifies this threat as generic phishing with a specific focus on impersonating financial restitution services, as evidenced by its Russian-language page title 'Mindfrontoud - Юридическая помощь при восстановлении финансовых потерь.' The domain is currently offline, though its infrastructure remains documented in threat intelligence systems. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered through Global Domain Group LLC on January 26, 2026, showing an anomalous future creation date that suggests potential WHOIS manipulation. Security vendors have flagged this domain 20 times out of 95 on VirusTotal, while it appears on one confirmed security blocklist. The site resolves to IP address 172.67.170.107, which is geolocated to Cloudflare infrastructure in California. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, a common configuration for both legitimate and malicious sites leveraging content delivery networks. Current status indicates the domain has been taken offline, though the underlying infrastructure may remain accessible through cached records or alternative routes. Organizations are advised to implement DNS-level blocking for 172.67.170.107 and monitor for domain re-registration attempts through the same registrar. End users should be alerted to the specific threat pattern of legal recovery scams, particularly those using Russian-language content and financial loss recovery themes. Network administrators should review proxy logs for connections to the documented IP address and investigate any related certificate usage patterns.