# PhishDestroy domain threat record: fortwears.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/fortwears.com/
Machine-readable companion: https://phishdestroy.io/domain/fortwears.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-06 21:02:13 UTC
- Last availability or vendor check: 2026-10-21 10:29:14 UTC
- Stored record updated: 2026-10-21 16:07:58 UTC
- VirusTotal detections in the stored snapshot: 7/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 46.29.26.38
- Registrar in stored WHOIS data: TuringSign Inc. d/b/a Cosmotown
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date (registry RDAP, fortwears.com): 2026-09-23 08:09:28 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1136e-aa8e-72b2-bdaa-87db1823bb59/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/fortwears.com
- Certificate Transparency search: https://crt.sh/?q=%25.fortwears.com
- Web Archive lookup: https://web.archive.org/web/*/https://fortwears.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
fortwears.com is a suspicious domain on the PhishDestroy blocklist. Its only visible label is a generic "Loading" page title, with no brand or product named. PhishDestroy first saw it on 2026-10-06, and it was still online with live content on 2026-10-19.

How the scam works
A page titled only "Loading" gives a visitor nothing to judge it by. Its real content may appear only after a script runs or the visitor is sent elsewhere. That pattern is common among pages that later ask for logins, card details or a wallet connection, and the security flags on this domain point to that kind of risk. What a victim stands to lose depends on what the page eventually requests: credentials, payment data or access to funds. Until the domain is classified, treat any prompt it shows as untrusted.

Evidence
Seven of 92 engines on VirusTotal flagged the domain as of 2026-10-12: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, LevelBlue and SOCRadar. That is a minority of engines, but these vendors run independent threat feeds that reached the same verdict. Spamhaus lists the domain in its DBL as a spam source. Three AlienVault OTX pulses also reference it, so other analysts have tied it to tracked activity.

Infrastructure
The domain was registered on 2026-09-23 through TuringSign Inc. d/b/a Cosmotown, just 13 days before PhishDestroy caught it. That short gap fits a site built for a brief campaign rather than an established business. It resolves to 46.29.26.38, on a network registered to M/S Robi Traders of Bangladesh but geolocated in Finland. Its free, automated Let's Encrypt certificate means the padlock in the browser says nothing about who runs the site.

What to do
If you typed a password into this site, change it everywhere you reuse it and turn on two-factor authentication. If you entered card details, contact your bank to block the card and dispute any charges. If you connected a crypto wallet or signed anything, treat that wallet as exposed and move your assets to a new one. Defenders should block fortwears.com and 46.29.26.38 at DNS and proxy level, and search logs for any traffic to them since 2026-09-23.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1136e-aa8e-72b2-bdaa-87db1823bb59/
VirusTotal report: https://www.virustotal.com/gui/domain/fortwears.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=fortwears.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:44:33 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/JLymfZ3/62d737d437cb.png
  Captured: 2026-10-06 22:58:04 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a1136e-aa8e-72b2-bdaa-87db1823bb59.png
  Captured: 2026-10-06 22:58:04 UTC
  Source report: https://urlscan.io/result/01a1136e-aa8e-72b2-bdaa-87db1823bb59/
- URLScan capture 2: https://screenshots.phishdestroy.io/01a0eb15-0d0e-70b8-8f24-f04ce12a8a9d.png
  Captured: 2026-10-06 21:02:13 UTC
  Source report: https://urlscan.io/result/01a1136e-aa8e-72b2-bdaa-87db1823bb59/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/504b7cef-fa77-4ce1-ba8e-e540f6ef3741.png
  Captured: 2026-10-06 21:04:03 UTC
  Source report: https://radar.cloudflare.com/scan/504b7cef-fa77-4ce1-ba8e-e540f6ef3741
  SHA-256: c903cd467a9e93dc0f4c940b5a3d24755247398efeaed7bef3a1fad7c9d15f83
- URLQuery: https://screenshots.phishdestroy.io/uq/96c3bdfc-48a4-4ffa-9771-149d45b7d1f5.png
  Source report: https://urlquery.net/report/96c3bdfc-48a4-4ffa-9771-149d45b7d1f5
  SHA-256: ea9ec5612fbdd53b810119601c050074c09e16a7a02fb957d6ced4a898b2c840
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cf86-29ee-73d9-80fa-b042b02beffa.png
  Captured: 2026-09-23 18:27:58 UTC
  Source report: https://urlscan.io/result/01a0cf86-29ee-73d9-80fa-b042b02beffa/
  SHA-256: 5b1a82e57311b1231f426e30bde6f1e09caaa2f8226f9f12a896b4017514548f
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb15-0d0e-70b8-8f24-f04ce12a8a9d.png
  Captured: 2026-09-29 02:53:47 UTC
  Source report: https://urlscan.io/result/01a0eb15-0d0e-70b8-8f24-f04ce12a8a9d/
  SHA-256: 38618eafffe806c0e272c8cbdc886fa484e1b3f73e05720b481b78b7022510ba
- URLScan · 2026-10-06: https://screenshots.phishdestroy.io/us/01a11308-644b-7368-b313-7fcff12c6477.png
  Captured: 2026-10-06 21:04:47 UTC
  Source report: https://urlscan.io/result/01a11308-644b-7368-b313-7fcff12c6477/
  SHA-256: 9fab537dd03e5994a5a02e5b9f3961aa1ae61f6017f4841df403bf28bf83f853
- URLScan · 2026-10-06: https://screenshots.phishdestroy.io/us/01a1130f-53b9-7765-9c02-bc9ea4a09dc2.png
  Captured: 2026-10-06 21:12:23 UTC
  Source report: https://urlscan.io/result/01a1130f-53b9-7765-9c02-bc9ea4a09dc2/
  SHA-256: 82ca58367f02c036acef899c960790cbc0a89a0b40d42fc05f2027e8fd8589bd
- URLScan · 2026-10-06: https://screenshots.phishdestroy.io/us/01a11321-4737-75be-8553-7533f8d162eb.png
  Captured: 2026-10-06 21:31:58 UTC
  Source report: https://urlscan.io/result/01a11321-4737-75be-8553-7533f8d162eb/
  SHA-256: 6294c173e2f1e8c7b3355796bd7ca129e4443fd658be19de873dfecf43156ec0
- URLScan · 2026-10-06: https://screenshots.phishdestroy.io/us/01a1134c-c284-73c6-8293-28db4c6f6a60.png
  Captured: 2026-10-06 22:19:32 UTC
  Source report: https://urlscan.io/result/01a1134c-c284-73c6-8293-28db4c6f6a60/
  SHA-256: e86a05b957d5de6c6fa87142c2478cd0107594e776ce93fae9a36fd29446a11c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T19:31:39Z",
        "uuid": "01a1136e-aa8e-72b2-bdaa-87db1823bb59",
        "scanned_at": "2026-10-06T22:56:29Z",
        "final_url": "https://fortwears.com/",
        "status": 200,
        "ip": "46.29.26.38",
        "ips": [
            "46.29.26.38"
        ],
        "asns": [
            "132359"
        ],
        "countries": [
            "TR"
        ],
        "doc_hash": "e7183554186abbb51a0a44c16629c61ebbe46687f586ae1184354ae560eed85c",
        "globals": [
            "_d0a0",
            "_a309",
            "_f563",
            "_s9fc",
            "_x393",
            "_x30a",
            "_xade",
            "_xbd2",
            "_x988",
            "_x03c",
            "_x546",
            "_x3d2",
            "_x53c",
            "_xfc6",
            "_x631",
            "_x27d",
            "_x617",
            "_x9d3",
            "_x5eb",
            "_x528",
            "_xbfc",
            "_x942",
            "_x4bb",
            "_x275",
            "_x34e",
            "_x8ae",
            "_xded",
            "_xf47",
            "_x477",
            "_xca6",
            "_x6e1",
            "_x2ea",
            "_xfb4",
            "_x01f",
            "_x06b",
            "_xb21",
            "_xc1d",
            "_xcbc",
            "_xe13",
            "_x8fd"
        ],
        "cookies": [
            "sil_ses",
            "__Host-sil_ses",
            "sil_gate",
            "__Host-sil_gate"
        ],
        "tls": {
            "san": [
                "fortwears.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "fortwears.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-22T07:30:11Z",
            "valid_from": "2026-09-23T07:30:12Z"
        },
        "domain_age_days": 2800,
        "apex_age_days": 2800,
        "tls_age_days": 13,
        "tls_valid_days": 89,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 49,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T19:40:33Z",
        "uuid": "504b7cef-fa77-4ce1-ba8e-e540f6ef3741",
        "scanned_at": "2026-10-06T21:04:03Z",
        "final_url": "https://fortwears.com/",
        "status": 200,
        "history": [
            {
                "url": "https://fortwears.com/",
                "status": 200
            }
        ],
        "dom_hash": "bc948235e9efeda3c8d176de53504109efd904a0c8a0ba260d9c0d5db04d3bb4",
        "doc_hash": "295f20e2230ccf76f7ce4160d73ed8aeace1780e9ea650cfbebfee3920a11b1e",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "fortwears.com",
                "type": "A",
                "value": "46.29.26.38"
            }
        ],
        "dnssec_valid": false,
        "ip": "46.29.26.38",
        "whois": {
            "registrar": "TuringSign Inc. d/b/a Cosmotown",
            "created": "2026-09-23T08:09:28Z",
            "updated": "2026-09-23T08:24:15Z",
            "expires": "2027-09-23T08:09:28Z",
            "nameservers": [
                "a.dnspod.com",
                "b.dnspod.com",
                "c.dnspod.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T11:51:17Z",
        "analysis_at": "2026-10-12T02:00:16Z",
        "stats": {
            "timeout": 0,
            "harmless": 49,
            "malicious": 5,
            "suspicious": 2,
            "undetected": 36
        },
        "detections": {
            "CRDF": "malicious",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "LevelBlue": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing, Spam (alphaMountain.ai)"
        },
        "registrar": "TuringSign Inc. d/b/a Cosmotown",
        "created": "2026-09-23T08:09:28Z",
        "expires": "2027-09-23T08:09:28Z",
        "updated": "2026-09-23T08:24:15Z",
        "first_seen": "2026-09-23T11:13:11Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "a.dnspod.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "b.dnspod.com"
            },
            {
                "ttl": 180,
                "type": "SOA",
                "rname": "domainadmin.dnspod.com",
                "value": "a.dnspod.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "46.29.26.38"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "c.dnspod.com"
            }
        ],
        "dns_at": "2026-10-12T02:00:36Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "fortwears.com"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6e5e2199c683b1acca223e547b0cec4d6a4",
            "sha256": "224fc3ba50a2b958edadcda8dc6bba16e168d906dd214164038220b839d7a6a5",
            "subject": "fortwears.com",
            "valid_to": "2026-12-22T07:30:11Z",
            "valid_from": "2026-09-23T07:30:12Z"
        },
        "whois": {
            "registrar": "TuringSign Inc. d/b/a Cosmotown",
            "registrar_iana_id": "1509",
            "registrar_url": "http://www.cosmotown.com",
            "created": "2026-09-23T08:09:28Z",
            "updated": "2026-09-23T08:24:15Z",
            "expires": "2027-09-23T08:09:28Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "a.dnspod.com",
                "b.dnspod.com",
                "c.dnspod.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2026-09-23T08:09:28Z",
                "registration": "2026-09-23T08:09:28Z",
                "registrar expiration": "2027-09-23T08:09:28Z",
                "last update of RDAP database": "2026-10-12T02:00:25Z"
            }
        }
    }
}
```