reentalserver[.]pro

reentalserver.pro was first observed on April 21, 2026 and is currently classified as an active Google brand‑impersonation campaign. The domain resolves to the Cloudflare address 104.21.75.187, which is geolocated to Canada and is served by the nameservers phoenix.ns.cloudflare.com and rex.ns.cloudflare.com. The site presents a valid Let's Encrypt certificate (issuer E7) despite a Gridinsoft trust score of 0 / 100, indicating a complete lack of reputation.

Security tooling has flagged the domain across multiple vectors. PhishDestroy has already blocked reentalserver.pro, and VirusTotal reports that 7 of 95 scanned security vendors raise detections, confirming malicious intent. AlienVault OTX references the domain in a single threat‑intelligence pulse, and it appears on one public blocklist. An HTTP request returns a 403 status code, suggesting that the site is either restricting access or that defensive controls are intercepting the traffic.

The campaign’s objective is identified as impersonating Google, consistent with the listed scam type of impersonation. While the exact page content has not been publicly disclosed, the presence of a brand‑target tag and the high‑risk rating imply that credential‑harvesting or credential‑reuse attacks are likely. The recent registration date and the use of a reputable CDN for rapid deployment are typical of opportunistic actors seeking to exploit trust in well‑known brands.

Defenders should immediately add reentalserver.pro to outbound and inbound blocklists at the network perimeter and on endpoint protection solutions. Monitoring of DNS queries for the domain and its associated Cloudflare IP should be instituted, and any observed connections should be logged and investigated. Given the low Gridinsoft score and existing blocklist entries, automated remediation via sinkholing or DNS‑based filtering can reduce exposure while broader threat‑intel feeds are consulted for potential related infrastructure.