az[.]fortset[.]info

PhishDestroy identifies az.fortset.info as an active credential-phishing domain masquerading as a legitimate service, specifically targeting users with a generic login-theft scheme. The domain leverages a spoofed interface to harvest entered credentials, with no direct association to a branded entity or known drainer kit, suggesting a low-cost, opportunistic campaign.

This domain was flagged by VirusTotal with 4/95 security vendors detecting malicious activity, indicating limited but present coverage. Resolving to 104.21.22.212 and issued a Let's Encrypt SSL certificate, it was registered with privacy protection obscuring ownership details. Public blocklist aggregators currently record 0 detections, while Google Safe Browsing (GSB) status remains unclassified. The domain’s creation date falls within the last 90 days, though exact registration data remains obscured by registrar privacy measures.

As of the latest scan, az.fortset.info remains actively hosted and accessible, with no evidence of takedown. Users interacting with this domain risk immediate credential compromise and potential follow-on identity theft. PhishDestroy recommends immediate network-level blocking of 104.21.22.212 and domain-wide DNS filtering. Exercise caution when encountering this domain—validate all login prompts through official, verified channels and report any incidents to your security team.