fortqa[.]com

PhishDestroy identifies fortqa.com as an active crypto drainer phishing domain employed in credential theft campaigns. This domain is being weaponized to impersonate legitimate crypto platforms and deceive users into connecting wallets, resulting in asset exfiltration via malicious smart contracts. The threat actor utilizes a generic drainer kit configured to target multiple blockchain networks, with current detection still limited across security vendors, indicating evolving evasion tactics.

This domain was flagged by 1 out of 95 VirusTotal security vendors, demonstrating low but present detection coverage. Registered through Porkbun LLC, the domain resolves to IP address 188.114.97.3 and was created on March 18, 2026, indicating a very recent inception. Let’s Encrypt SSL certificate is active, providing a false veneer of legitimacy. Google Safe Browsing (GSB) has not yet flagged this domain, but it remains absent from major blocklists such as PhishTank or OpenPhish at this time.

As of latest analysis, fortqa.com remains active and poses an elevated risk due to its advanced infrastructure and rapid deployment. Immediate action is required: users should block the domain at DNS and network levels, report the site to Google Safe Browsing and abuse channels, and avoid any interaction involving wallet connections or transaction approvals. The threat environment is dynamic, with this domain likely to evolve or migrate quickly. Proactive monitoring and community reporting are essential to mitigate potential financial losses and prevent further victimization.