rxtar[.]app

This domain, rxtar.app, is currently flagged as an active credential phishing threat with a high-risk classification. Infrastructure analysis reveals it resolves to the IP address 23.225.199.94 and is hosted behind a Let's Encrypt SSL certificate, a common tactic to lend legitimacy to malicious sites. The domain appears on two security blocklists and is referenced in 23 threat intelligence pulses, indicating prior detection by multiple security communities. Eleven security vendors have flagged this domain, though the exact nature of the phishing content remains unconfirmed as the page title is generic ('Welcome') and no brand or specific scam type has been identified in available data. Technologies detected on the domain include Bootstrap, Caddy, Swiper, Lodash, jQuery, and HSTS enforcement, suggesting a modern, potentially obfuscated phishing kit designed to evade detection or automate credential harvesting. The domain was registered through Dynadot LLC, a registrar frequently used for both legitimate and malicious purposes. Defenders should treat this domain as hostile and prioritize blocking or monitoring traffic to it, particularly in environments where credential theft poses a significant risk. Further analysis of the page content is recommended to determine the specific phishing lure or targeted brand, though no evidence currently links it to a known organization or scam category.