fortnate[.]vu

Analysis conducted on August 04, 2026, identifies fortnate.vu as an active phishing domain with high-risk indicators. The domain is currently resolving to IP address 172.67.183.93, which is part of Cloudflare's infrastructure, as confirmed by nameserver records (elliott.ns.cloudflare.com and ruth.ns.cloudflare.com). This hosting pattern is consistent with threat actors leveraging Cloudflare's services to obscure malicious infrastructure and evade detection. Security vendor assessments reveal that 8 of 91 engines on VirusTotal have flagged fortnate.vu as malicious, though the specific nature of the phishing content remains unconfirmed due to the absence of page title or brand target data in available intelligence.

The domain appears on two security blocklists and is actively blocked by PhishDestroy and OpenPhish, further corroborating its classification as a phishing threat. No registrar details or SSL certificate information were provided in the available data, limiting attribution efforts. Defenders are advised to treat this domain as hostile and implement blocking measures at the network level.

Given the use of Cloudflare nameservers, monitoring for additional domains leveraging the same infrastructure may help identify related campaigns. The domain's continued activity as of the report date underscores the need for real-time threat intelligence integration to mitigate exposure. Organizations should verify internal logs for any connections to 172.67.183.93 or fortnate.vu and conduct retrospective analysis to assess potential compromise.