employment-hr[.]info

Analysis of the domain employment-hr.info indicates active phishing infrastructure targeting human resources or employment-related credentials. Registered on February 4, 2026, through GoDaddy.com, LLC, the domain remains operational as of July 19, 2026. Infrastructure analysis reveals nameservers ns1.intelliwire.net, ns2.intelliwire.net, and ns3.intelliwire.com, resolving to IP address 64.191.166.219. The page title 'New Private Tab' suggests an attempt to obscure the site's purpose, a common tactic in phishing campaigns to evade detection or appear legitimate. Google Safe Browsing has flagged the domain for social engineering, and PhishDestroy includes it on its security blocklist. Eighteen of 95 security vendors on VirusTotal detect the domain as malicious, though the specific payload or phishing kit remains unconfirmed. The domain's thematic focus on employment or HR-related content, combined with its technical indicators, aligns with credential harvesting tactics. Defenders should treat this domain as high-risk and block access at the network level. Further investigation into the resolved IP and associated nameserver infrastructure may reveal additional linked phishing domains. The exact brand or organization being impersonated is not yet determined, and no evidence confirms the presence of a known phishing kit.