fortscanner[.]com

Analysis of fortscanner.com indicates a domain exhibiting characteristics consistent with phishing infrastructure, though conclusive classification remains under investigation. The domain was registered on March 28, 2026, through Global Domain Group LLC, a registrar frequently observed in fraudulent registrations. Its nameservers (a.dnspod.com, b.dnspod.com, c.dnspod.com) are associated with DNSPod, a provider commonly leveraged by threat actors to obscure hosting origins. The domain currently resolves to the IP address 193.187.110.3, which has been linked to other suspicious or confirmed malicious domains in recent months, though no direct malware distribution has been confirmed at this address.

As of July 31, 2026, the domain appears on one security blocklist, suggesting preliminary detection by at least one vendor, though the absence of detections from other sources does not preclude malicious intent. Notably, a scan by 91 vendors on VirusTotal returned no flags, though this should not be interpreted as an all-clear; many phishing domains evade initial detection through rapid rotation or obfuscation techniques. The domain remains active, and its infrastructure aligns with patterns observed in phishing campaigns targeting users of security software or network scanning tools, though the exact content or brand impersonation has not yet been confirmed. Defenders are advised to treat fortscanner.com as high-risk until further evidence emerges.

Network-level blocking is recommended, particularly for organizations in sectors where security tool impersonation could facilitate credential theft or lateral movement. Monitoring for connections to 193.187.110.3 and associated domains may reveal additional compromised endpoints. If the domain is encountered in user traffic, immediate isolation of affected devices and credential rotation for exposed accounts should be prioritized.