# PhishDestroy domain threat record: fortgs.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/fortgs.com/
Machine-readable companion: https://phishdestroy.io/domain/fortgs.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-22 13:13:24 UTC
- Stored record updated: 2026-10-22 16:30:29 UTC
- VirusTotal detections in the stored snapshot: 4/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored infrastructure

- Observed IP address: 193.187.110.10
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 200
- Registration date (registry RDAP, fortgs.com): 2026-10-12 16:20:52 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a13b7b-e7de-7629-877c-d5ee55158556/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/fortgs.com
- Certificate Transparency search: https://crt.sh/?q=%25.fortgs.com
- Web Archive lookup: https://web.archive.org/web/*/https://fortgs.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added fortgs.com to its internal blocklist as a suspicious domain. The site returned HTTP 200 with the recorded title “Loading”. The domain first appeared on PhishDestroy’s list on 2026-10-22 after Google Safe Browsing reported a social‑engineering threat.

How the scam works
The detections suggest the site may be used for generic social‑engineering attacks, such as tricking visitors into revealing credentials or personal data. No specific phishing page, wallet drainer, or malware delivery was observed on the captured snapshot.

Evidence
VirusTotal scanned the domain on 2026-10-16 and recorded four detections from 92 engines, including one malicious label (SOCRadar) and three suspicious labels (Fortinet, Gridinsoft, alphaMountain.ai). Google Safe Browsing flagged the domain as SOCIAL_ENGINEERING on 2026-10-22. urlscan.io captured the page on 2026-10-14; its overall verdict was clean, but its machine‑learning engine assigned a malicious score of 94. No external blocklists reported the domain and OTX listed zero pulses as of 2026-10-22.

Infrastructure
The domain was registered on 2026-10-12 with NICENIC INTERNATIONAL GROUP CO., LIMITED and uses the nameservers a.dnspod.com, b.dnspod.com, and c.dnspod.com. The recorded DNS A record pointed to 193.187.110.10, which was associated with Fast Zone IT in Turkey, and the TLS certificate observed was issued by Let’s Encrypt / YE2 and was valid until 2027-01-10. Open ports observed include 22, 80, and 443, and DNSSEC is not enabled.

What to do
Visitors should avoid entering any credentials or personal information on the site and, if they have already done so, change affected passwords and monitor accounts for unusual activity. Organizations can block the domain at the firewall or web proxy, and review logs for connections to 193.187.110.10. Continue to rely on up‑to‑date Google Safe Browsing and similar threat feeds for automated protection.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a13b7b-e7de-7629-877c-d5ee55158556/
Cloudflare Radar report: https://radar.cloudflare.com/scan/44137cdd-373b-41b7-9d51-0ae140bb7e69
Stored capture screenshot: https://urlscan.io/screenshots/01a13b7b-e7de-7629-877c-d5ee55158556.png
Cloudflare Radar screenshot (2026-10-22T13:20:38Z): https://screenshots.phishdestroy.io/cf/44137cdd-373b-41b7-9d51-0ae140bb7e69.png
URLScan screenshot (2026-10-22T13:19:35Z): https://screenshots.phishdestroy.io/us/01a163c4-3804-77a5-b34f-409130cd6a93.png
URLScan capture report: https://urlscan.io/result/01a163c4-3804-77a5-b34f-409130cd6a93/
VirusTotal report: https://www.virustotal.com/gui/domain/fortgs.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=fortgs.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 13:26:42 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a13b7b-e7de-7629-877c-d5ee55158556.png
  Captured: 2026-10-22 13:13:24 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a13b7b-e7de-7629-877c-d5ee55158556.png
  Source report: https://urlscan.io/result/01a13b7b-e7de-7629-877c-d5ee55158556/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/44137cdd-373b-41b7-9d51-0ae140bb7e69.png
  Captured: 2026-10-22 13:20:38 UTC
  Source report: https://radar.cloudflare.com/scan/44137cdd-373b-41b7-9d51-0ae140bb7e69
  SHA-256: fc4cdd1f13de6c4bc2304d359e99b87867cf641cf5f7aac4777d057a048554e9
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163c4-3804-77a5-b34f-409130cd6a93.png
  Captured: 2026-10-22 13:19:35 UTC
  Source report: https://urlscan.io/result/01a163c4-3804-77a5-b34f-409130cd6a93/
  SHA-256: 302174ffaebf51a0f8d855e966ebd7a8490940665276677e71ac2bd0687c7a45

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T13:23:44Z",
        "uuid": "01a13b7b-e7de-7629-877c-d5ee55158556",
        "scanned_at": "2026-10-14T17:35:45Z",
        "final_url": "https://fortgs.com/",
        "status": 200,
        "ip": "193.187.110.10",
        "ips": [
            "193.187.110.10"
        ],
        "asns": [
            "153947"
        ],
        "countries": [
            "TR"
        ],
        "doc_hash": "6b7597a872f8aa225c3535869dee1f645f5630720958321a71c00b8d19f30223",
        "globals": [
            "_d87a",
            "_aa39",
            "_f747",
            "_s269",
            "_x801",
            "_xd1f",
            "_xbae",
            "_x3af",
            "_x5e2",
            "_x0bd",
            "_x197",
            "_x894",
            "_xf04",
            "_x00e",
            "_xb7e",
            "_x3d2",
            "_xfc7",
            "_xeb1",
            "_xa6f",
            "_x0b7",
            "_x246",
            "_x2b7",
            "_xb5b",
            "_x25a",
            "_x9d7",
            "_xf1b",
            "_xb4e",
            "_x896",
            "_x37f",
            "_x8fe",
            "_x78d",
            "_x72b",
            "_xf38",
            "_x88a",
            "_xf21",
            "_xa00",
            "_x6b3",
            "_x837",
            "_x117",
            "_x9f4"
        ],
        "cookies": [
            "sil_ses",
            "__Host-sil_ses",
            "sil_gate",
            "__Host-sil_gate"
        ],
        "tls": {
            "san": [
                "fortgs.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "fortgs.com",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-10T15:28:10Z",
            "valid_from": "2026-10-12T15:28:11Z"
        },
        "domain_age_days": 2,
        "apex_age_days": 2,
        "tls_age_days": 2,
        "tls_valid_days": 89,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 94,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T13:23:45Z",
        "uuid": "44137cdd-373b-41b7-9d51-0ae140bb7e69",
        "scanned_at": "2026-10-22T13:20:38Z",
        "final_url": "https://fortgs.com/",
        "status": 200,
        "history": [
            {
                "url": "https://fortgs.com/",
                "status": 200
            }
        ],
        "dom_hash": "bc948235e9efeda3c8d176de53504109efd904a0c8a0ba260d9c0d5db04d3bb4",
        "doc_hash": "dde065034afcaba36633b0eee87a75e27a75570aa7d054a252224845ec2c263a",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "fortgs.com",
                "type": "A",
                "value": "193.187.110.10"
            }
        ],
        "dnssec_valid": false,
        "ip": "193.187.110.10",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-12T16:20:52Z",
            "updated": "2026-10-12T16:24:01Z",
            "expires": "2027-10-12T16:20:52Z",
            "nameservers": [
                "a.dnspod.com",
                "b.dnspod.com",
                "c.dnspod.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T13:20:00Z",
        "analysis_at": "2026-10-16T19:54:31Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 1,
            "suspicious": 3,
            "undetected": 36
        },
        "detections": {
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "spam"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Spam, Suspicious (alphaMountain.ai)"
        },
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-10-12T16:20:52Z",
        "expires": "2027-10-12T16:20:52Z",
        "updated": "2026-10-12T16:24:01Z",
        "first_seen": "2026-10-12T18:01:16Z",
        "dns": [
            {
                "ttl": 600,
                "type": "A",
                "value": "193.187.110.10"
            },
            {
                "ttl": 180,
                "type": "SOA",
                "rname": "domainadmin.dnspod.com",
                "value": "a.dnspod.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "b.dnspod.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "c.dnspod.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "a.dnspod.com"
            }
        ],
        "dns_at": "2026-10-16T19:56:03Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "fortgs.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5c1e7419ea806e90d3f90b97e44d156ee4e",
            "sha256": "c39f0ca70bf0079794a6a194abe174f339757529c553f1a24572ec6927ddff1d",
            "subject": "fortgs.com",
            "valid_to": "2027-01-10T15:28:10Z",
            "valid_from": "2026-10-12T15:28:11Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-10-12T16:20:52Z",
            "updated": "2026-10-12T16:20:52Z",
            "expires": "2027-10-12T16:20:52Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "a.dnspod.com",
                "b.dnspod.com",
                "c.dnspod.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-12T16:20:52Z",
                "registration": "2026-10-12T16:20:52Z",
                "registrar expiration": "2027-10-12T16:20:52Z",
                "last update of RDAP database": "2026-10-12T16:20:52Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T13:24:02Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "fortgs.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-22T13:18:03Z",
            "first": "2026-10-12T20:39:04Z",
            "changes": 2,
            "days_archived": 3,
            "scans_per_day": 0.21,
            "avg_page_bytes": 242701
        },
        "social_tags": {
            "title": "Loading",
            "robots": "noindex,nofollow"
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 223,
                "tls": 55,
                "wait": 212,
                "connect": 36,
                "download": 294
            },
            "response_ms": 820
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 2301958,
            "co2_grams": 0.0842,
            "cleaner_than": 1
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "43.130.172.75",
                    "host": "a.dnspod.com"
                },
                {
                    "ip": "43.161.3.75",
                    "host": "b.dnspod.com"
                },
                {
                    "ip": "43.134.249.75",
                    "host": "c.dnspod.com"
                }
            ],
            "zone": "fortgs.com"
        },
        "location": {
            "ip": "193.187.110.10",
            "asn": "153947",
            "org": "Fast Zone IT",
            "city": "Istanbul",
            "country": "TR"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "fortgs.com"
        },
        "dns": {
            "A": [
                "193.187.110.10"
            ],
            "NS": [
                "a.dnspod.com",
                "c.dnspod.com",
                "b.dnspod.com"
            ],
            "SOA": "{\"nsname\": \"a.dnspod.com\", \"hostmaster\": \"domainadmin.dnspod.com\", \"serial\": 1791911964, \"refresh\": 3600, \"retry\": 180, \"expire\": 1209600, \"minttl\": 180}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "193.187.110.10",
            "family": 4
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-12T16:20:52Z",
            "updated": "2026-10-12T16:24:01Z",
            "expires": "2027-10-12T16:20:52Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "a.dnspod.com",
                "b.dnspod.com",
                "c.dnspod.com"
            ]
        },
        "headers": {
            "headers": []
        }
    }
}
```