fortsk[.]icu

Analysis indicates that the domain fortsk.icu is actively engaged in phishing operations as of July 15, 2026. Registered on May 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 193.187.110.3. The SSL certificate is issued by Let's Encrypt, a common practice among threat actors to lend superficial legitimacy to malicious sites. The page title, 'Loading,' suggests the site may employ delayed rendering techniques to evade automated detection systems or present a deceptive interface after an initial blank or transitional state. Infrastructure analysis reveals that the domain is flagged by 7 of 95 security vendors on VirusTotal, indicating a moderate level of detection at this stage. Additionally, the domain appears in two threat intelligence pulses on AlienVault OTX, further corroborating its association with malicious activity. The specific brand or service being impersonated remains unconfirmed, as the page title does not reference a known entity, and no further indicators of compromise or campaign targeting have been publicly documented. Defenders are advised to block traffic to 193.187.110.3 and monitor for connections to fortsk.icu within their networks. Given the domain's recent registration and active status, organizations should treat it as a high-risk indicator until further analysis or takedown occurs. No additional details regarding the phishing kit, payload delivery mechanisms, or victim demographics are currently available.