# getcronos.net — SUSPICIOUS

> getcronos.net is a live credential theft site using brand impersonation, flagged by 1/95 VirusTotal scanners. Avoid entering sensitive data. Reported 2024-06-23.

## Summary
PhishDestroy identifies getcronos.net as an active credential theft domain impersonating legitimate services to harvest user logins. This site resolved to IP 104.21.53.147 and leveraged a Google Trust Services SSL certificate to appear trustworthy. The domain was registered on June 23, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and remains unblocked by most security vendors, with only 1 out of 95 VirusTotal scanners flagging it at time of analysis.  

This domain poses a direct risk to users who may be tricked into entering credentials under the false pretense of a legitimate service. The use of a valid SSL certificate and recent domain registration is a common tactic to bypass initial security checks. The attacker’s infrastructure suggests a coordinated effort to target users expecting reliable, branded web portals.  

Users who visited getcronos.net should immediately change passwords on all shared accounts, enable multi-factor authentication where available, and scan devices for malware. Report the domain to your security team or browser vendor. Avoid accessing this site further—it is confirmed malicious and actively propagating.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2024-06-23 16:10:43
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 104.21.53.147

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/853888a5-19aa-4fd7-8e7a-3536af260d3d
- PhishDestroy: https://phishdestroy.io/domain/getcronos.net/
- LLM endpoint: https://phishdestroy.io/domain/getcronos.net/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/getcronos.net/
Last updated: 2026-03-27