fortnicost[.]top

This domain, fortnicost.top, is identified as an active credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. Analysis indicates the domain mimics legitimate services to trick victims into entering usernames, passwords, and other authentication details, which are then captured by threat actors for unauthorized access or financial fraud. The infrastructure is configured to evade detection, though current indicators confirm its malicious intent. Infrastructure analysis reveals the domain was registered on March 26, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing and fraudulent domains. It resolves to the IP address 172.67.222.149, hosted on AS13335 Cloudflare, Inc., a network commonly leveraged to obscure malicious activity behind content delivery proxies. The domain appears on one security blocklist and is flagged by 17 out of 95 security vendors on VirusTotal, with detection labels including generic phishing and fraudulent credential collection. Notably, the domain lacks an SSL certificate, increasing the risk of interception during data transmission. Users who have visited fortnicost.top or entered credentials on the site should immediately revoke any submitted login details from associated accounts. It is recommended to enable multi-factor authentication on all critical services and monitor accounts for unauthorized activity. Network administrators should block the domain and its resolving IP address (172.67.222.149) at the perimeter to prevent further exposure. If credentials were entered, affected accounts should be considered compromised, and password resets should be performed on any service where the same credentials were reused. Organizations are advised to review logs for connections to this domain and investigate potential lateral movement or data exfiltration.