get-tron.org

The domain get-tron.org was observed in a phishing infrastructure campaign and is currently listed as active. Automated analysis shows that the site is blocked by the PhishDestroy filtering service and that it appears on a single public security blocklist. A full scan on VirusTotal was performed, involving 91 independent antivirus and URL‑reputation engines; at the time of analysis none of the engines reported a detection for the domain.

No additional information on registrar, registration date, hosting IP, ASN, or TLS certificate has been published in open sources, and attempts to retrieve HTTP response headers returned no definitive status codes. The page title and any branding displayed by the site have not been captured, leaving the specific lure or targeted brand undefined. Consequently, while the domain is confirmed to be part of a generic phishing operation, the exact payload, credential‑stealing mechanisms, and victim profile remain uncertain.

Risk level is under investigation, reflecting the limited publicly available evidence, and the status remains active, indicating the infrastructure may still be used to host credential‑harvesting pages. Defenders should continue to block get-tron.org at network perimeters, incorporate the domain into URL filtering and threat‑intel feeds, and monitor for any changes in its hosting characteristics or detection status. Ongoing re‑scans of VirusTotal and periodic checks against broader blocklists are recommended to capture any future malicious activity that may emerge.