oanda-international[.]com

This domain is flagged as a high-risk credential harvesting phishing site designed to mimic legitimate financial services. Analysis indicates the domain specifically targets users by impersonating a trusted currency trading platform, attempting to collect sensitive login credentials, payment details, and personal identification information through fraudulent login portals. The site employs social engineering tactics, including a deceptive page title matching the legitimate service, to increase the likelihood of successful compromise. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain is registered through GoDaddy.com, LLC and was created on November 26, 2025, an unusually recent date suggesting a short-lived operational lifespan typical of phishing campaigns. It appears on three distinct security blocklists, including PhishDestroy, MetaMask, and SEAL, and is flagged by 5 out of 95 security vendors on VirusTotal. The domain resolves to IP address 35.240.204.184, hosted on infrastructure belonging to AS396982 under Google LLC in Singapore, a common pattern observed in cloud-hosted phishing operations. Users who have visited oanda-international.com or entered credentials on the site should immediately take corrective action. All passwords associated with the account should be changed from a secure device, and multi-factor authentication should be enabled if not already active. Financial institutions should be notified to monitor for unauthorized transactions, and any payment details entered on the site should be reported as compromised. System scans using updated security tools are recommended to detect potential malware or browser-based persistence mechanisms. The domain remains active as of this assessment, and continued exposure poses a significant risk of identity theft and financial fraud.