forttop[.]shop

Analysis of forttop.shop indicates that the domain is actively used for a generic phishing campaign and is currently classified as high risk. The domain is listed on a single security blocklist and is explicitly blocked by the PhishDestroy service, demonstrating that at least one reputable anti‑phishing provider has identified malicious activity associated with the host. DNS resolution points to the IPv4 address 188.114.97.3, and the authoritative name servers are margaret.ns.cloudflare.com and troy.ns.cloudflare.com, confirming that the domain is hosted behind Cloudflare's infrastructure.

VirusTotal reports that 12 of 95 scanned security vendors flag the domain as malicious, providing independent confirmation of its suspicious nature. The domain remains active as of the report date, and no evidence of mitigation or takedown has been observed. While the available intelligence does not include details such as SSL certificate validity, HTTP response codes, page titles, or content analysis, the combination of blocklist inclusion, PhishDestroy blocking, and multiple vendor detections is sufficient to warrant immediate defensive action.

Network defenders should add forttop.shop to outbound filtering rules, ensure DNS resolvers block the domain, and monitor for any traffic to 188.114.97.3. Incident response teams should also consider correlating internal logs for connections to the domain and associated IP, and, if feasible, submit related artifacts to threat‑intelligence sharing platforms to improve collective detection. Continued observation is advised to capture any changes in hosting, additional blocklist listings, or emerging detection signatures.