fortresswallet[.]pro

This domain operates as an active crypto drainer, specifically designed to deceive users into connecting their cryptocurrency wallets to malicious smart contracts. Once connected, the site executes unauthorized transactions, siphoning funds directly from the victim's wallet to attacker-controlled addresses. The threat specializes in targeting users of decentralized finance (DeFi) platforms and non-custodial wallets, exploiting the irreversible nature of blockchain transactions. Infrastructure analysis reveals multiple high-risk indicators. The domain fortresswallet.pro was registered on June 2, 2026, through Dynadot Inc, an uncommon timeline suggesting potential domain spoofing or backdating. It resolves to a single IP address, 216.198.79.1, which has been associated with other fraudulent schemes in historical threat intelligence. Only 1 out of 95 security vendors on VirusTotal currently flag this domain, indicating low detection rates and possible evasion of automated defenses. Additionally, the domain appears on one security blocklist, and its SSL certificate is issued by Let's Encrypt (YR1), a common choice for malicious actors due to its free and automated issuance process. Users who have visited fortresswallet.pro or interacted with its content should immediately disconnect any connected wallets and revoke permissions via their wallet's connected sites management interface. All credentials, seed phrases, or private keys entered on this site must be considered compromised. Affected users should transfer remaining funds to a new, secure wallet using a clean device and monitor their transaction history for unauthorized activity. It is critical to report the domain to relevant threat intelligence platforms to aid in broader detection and mitigation efforts. Given the elevated risk level and active status of this threat, vigilance is advised for any communication or service claiming association with FortressWallet.