kronex[.]date

Analysis of the domain kronex.date shows a recent registration and active infrastructure that aligns with known phishing operations. The domain was created on July 17, 2026 and is hosted on Cloudflare’s network, as indicated by the authoritative name servers hera.ns.cloudflare.com and michael.ns.cloudflare.com and the resolution to IP address 172.67.205.165. Registration was performed through Ultahost, Inc., a registrar that has been associated with short‑lived malicious domains in prior threat intel.

The domain is currently listed on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, suggesting that at least one reputable anti‑phishing service has observed malicious activity originating from this host. VirusTotal scans report that three out of ninety‑one security vendors flagged kronex.date as malicious, providing independent confirmation of its suspicious nature. Publicly available metadata such as SSL certificate details, HTTP response codes, page title, or targeted brand information have not been released, leaving the exact payload and victim‑interaction mechanisms unverified.

Nevertheless, the combination of a newly created domain, Cloudflare edge hosting, registrar choice, blocklist inclusion, and multiple vendor detections constitutes a high‑confidence indicator of a phishing threat. Defenders should add kronex.date to network and endpoint deny lists, monitor DNS queries for lookups to 172.67.205.165, and ensure that email filters block any communications referencing this domain. Continuous re‑evaluation is advised, as further reconnaissance may reveal additional indicators such as malicious URLs, payloads, or victim reports that can refine detection rules.