fortnait[.]vip

This domain, fortnait.vip, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login information. Analysis indicates the infrastructure was engineered to mimic legitimate authentication portals, likely targeting users of online services or financial platforms. The page title 'Loading' suggests an attempt to simulate a legitimate loading sequence, potentially delaying user suspicion while backend scripts capture entered credentials. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain is flagged by 9 out of 95 security vendors on VirusTotal, confirming its malicious classification. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 91.227.114.14. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The SSL certificate, issued by Let's Encrypt, is consistent with phishing campaigns that leverage free certificates to appear legitimate. Additionally, the domain employs HTTP/3, a protocol rarely used in benign contexts but increasingly adopted by threat actors to evade detection and improve performance. Users who accessed fortnait.vip should take immediate action to mitigate potential compromise. First, revoke any credentials entered on the site, particularly if reused across other platforms. Monitor associated accounts for unauthorized activity, such as login attempts or transactions. If financial or personally identifiable information was submitted, consider placing a fraud alert with relevant institutions. System-level scans using updated security tools are recommended to detect any secondary payloads or malware. Organizations should update their blocklists to include this domain and its resolving IP address to prevent further exposure. Given the elevated risk level, affected users should also review connected devices for signs of lateral movement or persistent threats.