checkfort[.]info

Analysis indicates that the domain checkfort.info was registered on March 13, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently delegated to the Cloudflare authoritative nameservers harlan.ns.cloudflare.com and yolanda.ns.cloudflare.com. DNS resolution points to the IP address 172.67.219.206, which belongs to Cloudflare’s edge network and therefore masks the underlying hosting infrastructure. The domain is listed on one external security blocklist and is actively blocked by the PhishDestroy service, confirming that it is being treated as malicious by at least one reputable anti‑phishing repository. A VirusTotal scan shows that 15 out of 95 participating security vendors have flagged the domain as malicious, providing independent corroboration of its threat status.

The risk rating assigned by internal monitoring is high, and the operational status remains active as of the report date, July 22, 2026. No public page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts are available in the current intelligence set, leaving the exact content of the hosted page unverified. Likewise, no indicators from Open Threat Exchange or additional blocklists have been observed.

Given the combination of recent registration, Cloudflare‑based hosting, multiple vendor detections, and inclusion on a phishing‑specific blocklist, defenders should treat checkfort.info as a confirmed phishing infrastructure. Recommended actions include immediate DNS‑level blocking, updating intrusion‑prevention signatures to flag any outbound connections to the IP 172.67.219.206 when associated with the domain, and monitoring for newly created domains that share the same registrar or nameserver pair. Continuous re‑evaluation is advised in case further evidence, such as page content or SSL fingerprints, becomes available.