rnk-ex[.]net

The domain rnk-ex.net is currently flagged as an active generic phishing operation. Registration information shows the domain was created on March 15, 2025 and is registered through Gname.com Pte. Ltd. Its authoritative name servers are anton.ns.cloudflare.com and aspen.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and likely its CDN services. DNS resolution points to the IPv4 address 172.67.156.118, an IP range commonly associated with Cloudflare edge nodes, which can obscure the true origin of the hosting infrastructure and complicate takedown efforts. VirusTotal analysis reports that 1 of 91 security vendors have flagged the domain, suggesting at least one detection of malicious activity, while the domain appears on a single external blocklist.

PhishDestroy, a dedicated anti‑phishing service, has also listed rnk‑ex.net as blocked, reinforcing the assessment of malicious intent. The threat is classified as generic phishing, and the risk level is marked high. No additional evidence such as page title, SSL certificate details, HTTP response codes, or content snapshots is presently available, leaving the precise payload or lure unknown.

Defenders should treat rnk‑ex.net as hostile: block the domain at perimeter firewalls and proxy filters, add it to internal URL‑allow/deny lists, and monitor DNS queries for the associated Cloudflare IPs for any rapid changes. Continuous re‑scanning with multi‑vendor scanners is advised, as the low detection count may evolve. Organizations should also consider isolating outbound traffic to unknown Cloudflare‑hosted domains and enabling real‑time threat intelligence feeds that include the PhishDestroy blocklist to ensure rapid response if the domain’s infrastructure is repurposed or expanded.