hr-rewards[.]com

This domain, hr-rewards.com, operates as a credential harvesting phishing site designed to mimic corporate human resources portals. The site presents fraudulent employee reward programs or benefits enrollment pages to trick victims into entering login credentials, personal data, or financial information. Such schemes often target enterprise environments during open enrollment periods or performance review cycles, exploiting trust in HR communications to bypass security awareness filters. Analysis indicates this domain has been actively flagged by security systems, with 7 out of 95 security vendors on VirusTotal detecting it as malicious. The domain was registered on December 17, 2007, through MarkMonitor, Inc., a registrar commonly used for both legitimate corporate domains and phishing infrastructure. Additional indicators include its presence on two security blocklists (PhishDestroy and Hagezi) and two AlienVault OTX threat intelligence pulses. The site previously resolved to IP address 52.204.246.179 and used a Let’s Encrypt SSL certificate, a tactic frequently observed in phishing campaigns to create a false sense of legitimacy. If this domain was visited or interacted with, immediate action is required. Users should assume any credentials entered were compromised and reset passwords for all accounts accessed from the same device or network. Corporate IT teams should revoke active sessions and monitor for unauthorized access to HR systems, payroll portals, or internal directories. Devices used to access the site should be scanned for malware, as phishing pages may deploy additional payloads. Network logs should be reviewed for connections to 52.204.246.179 or related domains. Given the domain’s age and registrar, organizations should also check for similar lookalike domains registered through MarkMonitor that may be used in follow-up attacks.