fortinfo[.]live

PhishDestroy identifies fortinfo.live as an active crypto drainer posing significant risks to cryptocurrency users. The domain leverages deceptive tactics to trick victims into connecting wallets or sharing transaction details, resulting in direct asset depletion. Given its recent activity, this threat is classified as under_investigation but remains actively malicious, warranting immediate scrutiny and proactive blocking. The domain’s operational characteristics and infrastructure align with fast-evolving crypto drainer campaigns targeting unsuspecting traders and DeFi participants.

This domain was flagged through seed ceb233 following analysis of its technical footprint. fortinfo.live resolved to IP 172.67.144.140 at the time of discovery, a server associated with known malicious activity clusters. The domain was registered on March 11, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently exploited in bulk malicious registrations. Although VirusTotal currently shows 8/95 detections, the absence of flagging does not imply safety—crypto drainers often evade detection until after widespread victimization. No current presence on major blocklists was detected during the initial assessment, suggesting the threat is still in early dissemination.

To mitigate exposure to fortinfo.live and similar threats, users must adopt strict verification protocols before interacting with any crypto-related domain. Always confirm URLs via trusted sources or PhishDestroy before clicking, avoid clicking unsolicited links in messages or social media, and use hardware wallets or transaction previews to verify on-chain outputs. Organizations should block fortinfo.live and the associated IP at DNS and network levels. PhishDestroy continues to monitor this domain and urges users to report any suspicious interactions for further investigation and community protection.