check-fort[.]xyz

On July 20, 2026, the domain check-fort.xyz was observed to be actively hosting a generic phishing campaign. The domain was registered on June 20, 2026 through Global Domain Group LLC and is currently resolved to the IPv4 address 85.239.149.81. Authoritative name servers listed are a.dnspod.com, b.dnspod.com and c.dnspod.com, indicating use of the DNSPod service. VirusTotal analysis shows that one of ninety‑five scanning engines flagged the domain as malicious, and the domain appears on a single public blocklist, where it is listed by PhishDestroy. No additional public reputation services, safe‑browsing checks, or SSL/TLS observations have been published for this host. The limited detection footprint suggests that the infrastructure is relatively new, consistent with the recent registration date, and may be operated by a threat actor testing evasion techniques. Because the only concrete indicator is the IP resolution and the blocklist entry, defenders should treat any traffic to check-fort.xyz as potentially hostile. Recommended mitigation steps include adding the domain and its resolved IP address to network deny lists, monitoring DNS queries for the listed name servers, and employing endpoint protection that respects the VirusTotal detection. Continuous re‑evaluation is advised, as additional intelligence such as HTTP response codes, page content, or certificate data could emerge and refine the risk posture.