app[.]fortbiit[.]com

This domain is flagged as an elevated-risk phishing site specializing in brand impersonation, specifically targeting Celer, a known blockchain and layer-2 scaling platform. The site masquerades as a legitimate stocks trading and portfolio management service under the name 'Fortbit,' attempting to deceive users into disclosing sensitive financial or login credentials. Analysis indicates the domain was registered on June 16, 2025, through COSMOTOWN, INC. and resolves to the IP address 163.61.188.2. It appears on one security blocklist and is currently blocked by PhishDestroy. The Gridinsoft trust score for this domain is 0/100, reflecting high-risk classification. VirusTotal reports that 10 out of 95 security vendors have flagged this domain as malicious. Detected technologies include LiteSpeed web server, Smartsupp live chat, jQuery, GetButton, and HTTP/3, which may be leveraged to enhance the site's appearance of legitimacy or facilitate data exfiltration. Mitigation steps for this threat include blocking the domain and its associated IP (163.61.188.2) at the network perimeter. Organizations should update endpoint protection rules to flag or quarantine any attempts to access this domain. Users who may have interacted with the site should reset credentials for Celer and any financial accounts accessed during the suspected compromise. Security teams are advised to monitor for indicators of compromise, such as unusual login attempts or unauthorized transactions, particularly for users who visited the domain while it was active.