# PhishDestroy domain threat record: fortnw.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/fortnw.com/
Machine-readable companion: https://phishdestroy.io/domain/fortnw.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-06 21:01:15 UTC
- Last availability or vendor check: 2026-10-21 10:29:12 UTC
- Stored record updated: 2026-10-21 16:07:58 UTC
- VirusTotal detections in the stored snapshot: 7/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 46.29.26.38
- Registrar in stored WHOIS data: TuringSign Inc. d/b/a Cosmotown
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-09-22 03:55:19 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a11308-cab2-75ff-8fe2-fb7495311ab4/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/fortnw.com
- Certificate Transparency search: https://crt.sh/?q=%25.fortnw.com
- Web Archive lookup: https://web.archive.org/web/*/https://fortnw.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
fortnw.com is on the PhishDestroy blocklist as a suspicious domain. Its page shows nothing more than the title "Loading", and we have not tied it to a specific brand or scheme. PhishDestroy first saw it on 2026-10-06. On 2026-10-19 the site was still online and serving live content, so anyone who receives a link to it can still reach it.

How the scam works
A page that only says "Loading" gives a visitor no reason to trust it. The real content usually appears after a script runs or a redirect fires, and that content can be a credential form, a fake wallet prompt or a download. Because several security engines already flag this domain, the safest assumption is that whatever loads is built to take something from the visitor, such as passwords, personal details or wallet access. We have not confirmed which of these it targets.

Evidence
On 2026-10-12, VirusTotal showed 7 of 92 engines flagging the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, Kaspersky, LevelBlue and SOCRadar. That is a minority of engines, but these are independent vendors, including Kaspersky and Forcepoint, reaching the same conclusion about a domain that is only weeks old. Four AlienVault OTX threat pulses also reference it, so other researchers are tracking it as well. PhishDestroy is currently the only blocklist in our set that lists it.

Infrastructure
The domain was registered on 2026-09-22 through TuringSign Inc. d/b/a Cosmotown, two weeks before PhishDestroy detected it. A domain that goes from registration to multiple threat flags this fast fits the profile of short-lived abuse infrastructure. It resolves to 46.29.26.38, an address geolocated in Finland but announced by M/S ROBI TRADERS, a network registered in Bangladesh. The site has a free Let's Encrypt certificate, so the browser padlock says nothing about whether it is legitimate.

What to do
If you opened fortnw.com, close it and do not act on any prompt that appeared after the loading screen. If you typed a password there, change it on every service where you reuse it, and turn on app-based two-factor authentication. If you connected a crypto wallet or signed anything, revoke the permissions you granted with a token-approval checker and move your funds to a fresh wallet. If you downloaded a file, delete it and run a malware scan. Security teams should block the domain and its IP at the DNS and proxy level and review logs for visits since 2026-09-22.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a11308-cab2-75ff-8fe2-fb7495311ab4/
VirusTotal report: https://www.virustotal.com/gui/domain/fortnw.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=fortnw.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:44:30 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/0j7SRB5Z/0d3a5d1d89e0.png
  Captured: 2026-10-06 21:05:55 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a11308-cab2-75ff-8fe2-fb7495311ab4.png
  Captured: 2026-10-06 21:05:55 UTC
  Source report: https://urlscan.io/result/01a11308-cab2-75ff-8fe2-fb7495311ab4/
- URLScan capture 2: https://urlscan.io/screenshots/01a0c967-819a-74fa-b1e9-3433184a41a7.png
  Captured: 2026-10-06 21:01:15 UTC
  Source report: https://urlscan.io/result/01a11308-cab2-75ff-8fe2-fb7495311ab4/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/19aec3d8-9de1-4922-ae92-c3c6865db610.png
  Captured: 2026-10-06 21:04:01 UTC
  Source report: https://radar.cloudflare.com/scan/19aec3d8-9de1-4922-ae92-c3c6865db610
  SHA-256: c12b668cbc88bd84bb10b3dfe70e72f7247c55cdadbfb0b9d4bc0742f441745b
- URLQuery: https://screenshots.phishdestroy.io/uq/97c949b8-fe03-4b2e-bf4b-81279cbf42d3.png
  Source report: https://urlquery.net/report/97c949b8-fe03-4b2e-bf4b-81279cbf42d3
  SHA-256: 9c00ff2965e838e7b4228398719fb70cd64b89b4c22290370ea28a2f16dea5c6
- URLScan · 2026-09-22: https://screenshots.phishdestroy.io/us/01a0c967-819a-74fa-b1e9-3433184a41a7.png
  Captured: 2026-09-22 13:56:46 UTC
  Source report: https://urlscan.io/result/01a0c967-819a-74fa-b1e9-3433184a41a7/
  SHA-256: cbd263e4575ab7a9f0316694cb2bebb2dc505be13adf605a9a5a7d08d7592336
- URLScan · 2026-10-06: https://screenshots.phishdestroy.io/us/01a11308-836e-77cb-b10b-49716f041724.png
  Captured: 2026-10-06 21:04:54 UTC
  Source report: https://urlscan.io/result/01a11308-836e-77cb-b10b-49716f041724/
  SHA-256: d94786da49220e01797fd178545d08d210f0f18898ef4c8b6d869cf88f8528d9

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T19:31:38Z",
        "uuid": "01a11308-cab2-75ff-8fe2-fb7495311ab4",
        "scanned_at": "2026-10-06T21:05:18Z",
        "final_url": "https://fortnw.com/",
        "status": 200,
        "ip": "46.29.26.38",
        "ips": [
            "46.29.26.38"
        ],
        "asns": [
            "132359"
        ],
        "countries": [
            "TR"
        ],
        "doc_hash": "373e47755d7eae82d8d44dfa5292f66a1287634d0a3a9c47405476f5ca14f573",
        "globals": [
            "_d5d9",
            "_ad9a",
            "_fa39",
            "_s3d4",
            "_x9f1",
            "_xc0c",
            "_x6f9",
            "_xdee",
            "_xcda",
            "_xf59",
            "_x5e2",
            "_xcde",
            "_xe8e",
            "_xace",
            "_x26f",
            "_x597",
            "_xffb",
            "_x559",
            "_x77c",
            "_x321",
            "_xe05",
            "_xfca",
            "_x868",
            "_x844",
            "_x231",
            "_x83e",
            "_x9d8",
            "_x33e",
            "_xc56",
            "_xa9f",
            "_x9f9",
            "_xe49",
            "_x40b",
            "_xeac",
            "_x620",
            "_x886",
            "_x582",
            "_x2fc",
            "_x498",
            "_xa3f"
        ],
        "cookies": [
            "sil_ses",
            "__Host-sil_ses",
            "sil_gate",
            "__Host-sil_gate"
        ],
        "tls": {
            "san": [
                "fortnw.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "fortnw.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-21T05:34:54Z",
            "valid_from": "2026-09-22T05:34:55Z"
        },
        "domain_age_days": 480,
        "apex_age_days": 480,
        "tls_age_days": 14,
        "tls_valid_days": 89,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 81,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T19:40:32Z",
        "uuid": "19aec3d8-9de1-4922-ae92-c3c6865db610",
        "scanned_at": "2026-10-06T21:04:01Z",
        "final_url": "https://fortnw.com/",
        "status": 200,
        "history": [
            {
                "url": "https://fortnw.com/",
                "status": 200
            }
        ],
        "dom_hash": "bc948235e9efeda3c8d176de53504109efd904a0c8a0ba260d9c0d5db04d3bb4",
        "doc_hash": "b211db2a087a43d405eba31689e653e559454f855e66b78af43613baee5fb6d7",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "fortnw.com",
                "type": "A",
                "value": "46.29.26.38"
            }
        ],
        "dnssec_valid": false,
        "ip": "46.29.26.38",
        "whois": {
            "registrar": "TuringSign Inc. d/b/a Cosmotown",
            "created": "2026-09-22T05:55:19Z",
            "updated": "2026-09-22T06:08:11Z",
            "expires": "2027-09-22T05:55:19Z",
            "nameservers": [
                "a.dnspod.com",
                "b.dnspod.com",
                "c.dnspod.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T11:51:16Z",
        "analysis_at": "2026-10-12T18:11:37Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 4,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "SOCRadar": "phishing",
            "LevelBlue": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)"
        },
        "registrar": "TuringSign Inc. d/b/a Cosmotown",
        "created": "2026-09-22T05:55:19Z",
        "expires": "2027-09-22T05:55:19Z",
        "updated": "2026-09-22T06:08:11Z",
        "first_seen": "2025-06-14T09:04:21Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "b.dnspod.com"
            },
            {
                "ttl": 180,
                "type": "SOA",
                "rname": "domainadmin.dnspod.com",
                "value": "a.dnspod.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "a.dnspod.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "c.dnspod.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "46.29.26.38"
            }
        ],
        "dns_at": "2026-10-12T18:12:05Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "fortnw.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5b348e839476478f3bb0c5b5165745fb961",
            "sha256": "4ab702d9f1b0786b7fff7238f5914b2e73cdfc63b9800c699a4415c0d0f931ef",
            "subject": "fortnw.com",
            "valid_to": "2026-12-21T05:34:54Z",
            "valid_from": "2026-09-22T05:34:55Z"
        },
        "whois": {
            "registrar": "TuringSign Inc. d/b/a Cosmotown",
            "registrar_iana_id": "1509",
            "registrar_url": "http://www.cosmotown.com",
            "created": "2026-09-22T05:55:19Z",
            "updated": "2026-09-22T06:08:11Z",
            "expires": "2027-09-22T05:55:19Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "a.dnspod.com",
                "b.dnspod.com",
                "c.dnspod.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2026-09-22T05:55:19Z",
                "registration": "2026-09-22T05:55:19Z",
                "registrar expiration": "2027-09-22T05:55:19Z",
                "last update of RDAP database": "2026-10-10T18:09:40Z"
            }
        }
    }
}
```