apps[.]rtl[.]hr

This domain is flagged as an elevated-risk credential harvesting portal targeting users of RTL HR services. Analysis indicates the infrastructure is designed to mimic legitimate login pages, tricking victims into submitting corporate or personal credentials through deceptive input forms. The specific threat type is brand impersonation combined with fake login functionality, a common vector for corporate espionage and account takeover attacks. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain apps.rtl.hr resolves to IP address 178.218.170.22 and was originally registered on May 18, 2003, though recent malicious activity suggests potential domain hijacking or repurposing. Security vendors on VirusTotal flag this domain at 7/95 detection rate, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Detected technologies include PHP, Apache HTTP Server, and HTTP Strict Transport Security (HSTS), with a Let's Encrypt SSL certificate providing false legitimacy. The current 404 status indicates recent takedown efforts, though historical DNS records may still pose residual risk. Organizations should implement immediate mitigation measures to prevent credential harvesting through this domain. Network-level protections should block all traffic to 178.218.170.22 and the apps.rtl.hr domain at perimeter firewalls and DNS resolvers. Security teams must conduct internal sweeps for any systems that may have interacted with this infrastructure, particularly focusing on HTTP referrer logs and SSL certificate transparency records. Employee awareness training should emphasize verification of domain authenticity before entering credentials, especially for HR portals and corporate services. Given the domain's long registration history, security teams should also investigate whether this represents a compromised legitimate domain or a dedicated malicious registration, adjusting monitoring parameters accordingly for both scenarios.