fortaura[.]info

Analysis as of July 31, 2026 shows that fortaura.info was registered on May 12, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is served by the DNS providers a.dnspod.com, b.dnspod.com and c.dnspod.com. The domain resolves to the IPv4 address 158.94.211.169. VirusTotal records indicate that the domain has been scanned by 91 antivirus and URL‑reputation vendors, none of which have returned a positive detection at the time of review. This lack of detections should not be interpreted as evidence of legitimacy, as the domain is currently classified as a generic phishing site and appears on one external security blocklist.

The blocklist entry is also reflected in the PhishDestroy feed, which actively blocks the domain. No additional public indicators such as SSL certificate details, HTTP status codes, page title, or brand targeting have been published, leaving the exact content and attack vector unverified. Consequently, the primary uncertainty concerns the payload delivered after a victim follows the malicious link, as well as any potential secondary infrastructure that may be leveraged. Defenders should treat fortaura.info as malicious until further analysis confirms otherwise.

Recommended actions include adding the domain and its resolving IP address to network and web‑proxy blocklists, monitoring DNS queries for the associated nameservers, and employing threat‑intel feeds that include the PhishDestroy entry. Continuous re‑scanning on VirusTotal or similar platforms is advised to capture any future detections. Logging of any outbound connections to 158.94.211.169 and correlating with user activity can help identify compromised hosts. Organizations using DNS filtering should ensure that queries to a.dnspod.com, b.dnspod.com and c.dnspod.com are not inadvertently allowed for this domain.