# PhishDestroy threat dossier — fortbox.fun ================================================================ Fetched: 2026-05-15 15:01:54 UTC Canonical: https://phishdestroy.io/domain/fortbox.fun/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: phishing_login Targeted brand: fortnite Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_divergence) (score: 3/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/95 security vendors flagged this domain Flagging vendors: ESET ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 104.21.80.226 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: Cloudflare, Inc. Registrar: Global Domain Group LLC Nameservers: amir.ns.cloudflare.com, amy.ns.cloudflare.com Registered: 2026-04-28 Page title: Fortnite Inventory Checker ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-28 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-12 18:43:14 UTC (by PhishDestroy tracker) First reported: 2026-05-12 15:44:14 UTC (abuse notice filed) Last verified: 2026-05-15 07:36:29 UTC Neutralised: 2026-05-12 19:38:08 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e1cd8-e3fb-7065-a200-4fbb4fd4e4d3/ URLQuery: https://urlquery.net/report/e81dd71f-4cb3-46da-bac3-131da8e61626 Wayback Machine: https://web.archive.org/web/*/fortbox.fun crt.sh CT logs: https://crt.sh/?q=%25.fortbox.fun Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=fortbox.fun AlienVault OTX: https://otx.alienvault.com/indicator/domain/fortbox.fun URLhaus: https://urlhaus.abuse.ch/host/fortbox.fun/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-12 18:44:53 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies fortbox.fun as an active, elevated-risk phishing domain posing as a legitimate service to harvest user credentials. This domain represents a clear credential theft threat, with adversaries leveraging social engineering to trick victims into submitting sensitive login information. The site’s immediate availability and the presence of a valid SSL certificate issued by Let’s Encrypt may further lend it an air of legitimacy at first glance—heightening the risk of successful deception. This domain was flagged by 1 out of 95 VirusTotal security vendors. It resolves to IP address 104.21.80.226 and was registered through Global Domain Group LLC on April 28, 2026. While the domain currently sits at low detection coverage, its active status and hosting configuration suggest ongoing operations. The use of Let’s Encrypt for SSL suggests the threat actors are prioritizing perceived trust, likely to bypass browser warnings and increase engagement. Given the recency of domain registration and the lack of broad blocklisting, this phishing campaign may be in an early or targeted phase. To mitigate risk, users must avoid interacting with fortbox.fun entirely. Organizations should block the domain at DNS and firewall levels, and inspect outbound traffic for connections to 104.21.80.226. Security teams are advised to monitor for related TLS certificate issuance patterns using Let’s Encrypt logs and to warn users about spoofed login prompts. Proactive user awareness training on identifying phishing lures is strongly recommended to reduce the likelihood of credential compromise through this or similar campaigns. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260512-813DC2 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/fortbox.fun/ JSON API: https://api.destroy.tools/v1/check?domain=fortbox.fun Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 149,827 domains (36,935 alive under monitoring, 112,570 confirmed takedowns/dead). Site: https://phishdestroy.io