ren-flowdex[.]com

ren-flowdex.com is currently active and serves HTTP content with a 200 response. The site was registered on 21 February 2026 through NETIM SAS and uses the nameservers ns1.netim.net, ns2.netim.net, ns3.netim.net. It resolves to 104.168.101.30, an address owned by AS36352 (HostPapa) located in the United States. The TLS certificate is issued by Let’s Encrypt (YR1). The page title returned by the server reads “Ren Flowdex | Danmarks officielle hjemmeside 2026”, suggesting an attempt to appear as an official Danish site, and the domain has been classified as a social‑media phishing campaign. Reputation data show the domain appears on one security blocklist and is listed by PhishDestroy. Gridinsoft assigns a trust score of 0/100. VirusTotal scanning indicates a single detection out of 93 scanners. The limited detection count, combined with the low trust score and blocklist presence, points to a high‑risk profile. No additional technical artefacts such as malware payloads, credential‑stealing forms, or redirect chains have been disclosed. Consequently, defenders should block network resolution to 104.168.101.30, add the domain to URL filtering policies, and monitor for any outbound connections or credential submissions targeting this host. Ongoing collection of payload samples and deeper page analysis is required to confirm the exact phishing workflow.