rtonline[.]net

This domain, rtonline.net, is flagged as a brand impersonation phishing site targeting Planet Networks, a residential and business fiber internet provider. Analysis of the page title, "Residential & Business Fiber Internet | Planet Networks," confirms the domain was designed to mimic the legitimate brand’s identity, likely to harvest user credentials or distribute fraudulent service offers. No cryptocurrency drainer kit signatures were detected, but the impersonation tactic aligns with credential theft or social engineering campaigns. The infrastructure shows no direct ties to known malware distribution networks, though the intent remains malicious. Infrastructure analysis reveals the domain was registered on April 21, 2026, through eNom, LLC, a registrar frequently exploited for phishing operations. It resolved to the IP address 198.49.23.144 and was secured with a Let’s Encrypt SSL certificate, a common tactic to appear legitimate. VirusTotal reports 4 out of 95 security vendors flagging the domain, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and was blocked by PhishDestroy. Google Safe Browsing (GSB) status is not explicitly noted, but the low detection rate suggests evasion techniques were employed to delay widespread flagging. The domain is currently offline, reducing immediate risk to end users. However, historical DNS records and registrar data indicate the infrastructure could be reactivated or repurposed for future campaigns. Organizations should monitor for re-emergence under the same registrar or IP range and update blocklists accordingly. Users who interacted with the domain should reset credentials for any accounts accessed during the exposure window, particularly those tied to internet service providers or financial platforms. The elevated risk level persists due to the domain’s creation date discrepancy (2026), suggesting potential typosquatting or pre-registered malicious infrastructure.