fortweg[.]top

This domain, fortweg.top, is identified as an active credential theft operation designed to harvest user login credentials through deceptive web portals. Analysis indicates the site does not currently impersonate a specific brand but employs generic login forms to capture sensitive information. The infrastructure lacks overt ties to known crypto drainer kits, suggesting a focus on traditional credential harvesting rather than cryptocurrency-specific attacks. Technical indicators reveal the domain was registered on March 28, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domains. It resolves to the IP address 188.114.96.3, located in the United States under AS13335 (Cloudflare, Inc.), a common hosting provider for threat actors due to its anonymity features. The domain is flagged by 12 out of 95 security vendors on VirusTotal, with one active blocklist entry (PhishDestroy). The SSL certificate, issued by Let's Encrypt (serial number E7), further confirms the domain's active status, though it provides no legitimacy to the malicious content. Notably, the domain's creation date is anomalous, as it predates the current date, indicating either a typo in registration records or an attempt to manipulate WHOIS data for evasion. As of the latest assessment, fortweg.top remains active, serving a 500 Internal Server Error page, which may indicate temporary downtime or a placeholder for future malicious activity. The use of Cloudflare hosting complicates takedown efforts, as the service masks the true origin of the infrastructure. Users and organizations are advised to block the domain at the DNS level and monitor for related indicators, such as the associated IP address and SSL certificate. Given the domain's high-risk classification and active blocklist presence, heightened vigilance is recommended, particularly for sectors frequently targeted by credential theft campaigns, such as financial services and e-commerce.