rnetarnask[.]org

Analysis of rnetarnask.org indicates a confirmed phishing infrastructure operating as a redirector. The domain, registered on February 21, 2026, through NiceNIC International Group Co., Limited, currently resolves to IP 188.114.96.3, hosted by Cloudflare, Inc. in Canada. Infrastructure analysis reveals Cloudflare nameservers (arnold.ns.cloudflare.com, destiny.ns.cloudflare.com), a common pattern for obfuscating malicious traffic. The domain returns an HTTP 302 status code, suggesting it is actively redirecting visitors to downstream phishing endpoints, though the final destination remains unconfirmed. As of July 13, 2026, rnetarnask.org is flagged on three security blocklists and is explicitly blocked by at least two independent detection systems. VirusTotal reports 2 of 93 security vendors marking the domain as malicious, though this detection rate is low relative to confirmed phishing domains, indicating either early-stage abuse or evasion techniques. The page title, 'www.www.rnetarnask.org,' provides no actionable brand or content intelligence, and no specific phishing kit or targeted brand has been identified in available data. Defenders should treat this domain as high-risk due to its active redirect behavior, Cloudflare-hosted infrastructure, and presence on multiple blocklists. Network-level blocking is recommended, particularly for organizations with exposure to credential theft or financial fraud risks. Further analysis of downstream domains or IPs associated with the 302 redirects may reveal additional compromised infrastructure. The domain's creation date (less than five months old) aligns with typical phishing lifecycle patterns, suggesting it may remain active for a limited period before being abandoned or seized.