fortso[.]com

PhishDestroy identifies fortso.com as an active crypto drainer phishing domain under investigation, flagged for attempting to siphon cryptocurrency from unsuspecting victims. The site employs deceptive social engineering tactics to trick users into connecting their wallets or entering private keys, then initiates unauthorized transactions to drain funds. Like many crypto drainers, fortso.com leverages urgency and fake rewards to bypass user skepticism. Technical indicators reveal this domain was only recently registered on December 08, 2025, making it a fresh threat with minimal historical trust. Its SSL certificate issued by Let’s Encrypt provides a false sense of security, while the domain resolves to IP address 186.2.171.13 in Vietnam, hosted by a registrar (MAT BAO CORPORATION) with limited oversight. Notably, fortso.com currently evades detection by all 95 VirusTotal engines, underscoring its stealth and rapid operational deployment.

This domain’s timeline is a critical red flag: zero detections on VirusTotal despite active hosting, a creation date just days ago, and no established reputation. Such metrics are typical of opportunistic crypto drainers that emerge, operate briefly, and disappear before blocklists update. Users interacting with fortso.com risk immediate asset loss if they connect wallets or input seed phrases, as crypto drainers automatically execute unauthorized transfers upon gaining access. The absence of prior reports also suggests this campaign may be part of a broader wave targeting early adopters or specific blockchain communities. Defenders should treat fortso.com as hostile infrastructure until proven otherwise, especially given its reliance on newly minted domains and Let’s Encrypt certs.

If you visited fortso.com or entered any information, act immediately to secure your assets and identity. Disconnect any connected wallets using blockchain explorers or wallet settings, revoke any suspicious approvals via tools like revoke.cash, and transfer remaining funds to a new wallet if compromise is suspected. Report the domain to your antivirus vendor and platforms like PhishTank or URLVoid. Use network-level blocking (e.g., Pi-hole, local hosts file, or firewall rules) to prevent further access. Monitor blockchain transaction logs for unauthorized activity and consider using real-time alerting services for your wallet addresses. Given the crypto drainer threat, assume compromise and act with urgency—crypto losses are often irreversible.