fortmer[.]cfd

Analysis indicates that fortmer.cfd is an active malicious infrastructure associated with generic phishing. The domain was registered on 11 May 2026 through Spaceship, Inc. and is managed by DNSPod nameservers a.dnspod.com, b.dnspod.com, c.dnspod.com. DNS resolution points to the single IPv4 address 158.94.211.169, which is the only visible host for the campaign. VirusTotal reports that three of ninety‑one scanning engines have flagged the domain, confirming the presence of malicious activity despite a relatively low detection count. The short lifespan, recent registration, and use of a free DNS provider are consistent with disposable phishing operations. No additional infrastructure such as CDN, email servers, or secondary IPs has been observed, and the lack of further intelligence leaves the full scope of the campaign uncertain. Defenders should treat fortmer.cfd as high‑risk: block DNS resolution and any outbound connections to the listed IP, monitor for related hostnames or similar DNSPod name patterns, and incorporate the domain into threat‑intel feeds. Ongoing observation of the IP reputation and any future VirusTotal updates is recommended to adjust response actions.