fortbox[.]fun

PhishDestroy identifies fortbox.fun as an active, elevated-risk phishing domain posing as a legitimate service to harvest user credentials. This domain represents a clear credential theft threat, with adversaries leveraging social engineering to trick victims into submitting sensitive login information. The site’s immediate availability and the presence of a valid SSL certificate issued by Let’s Encrypt may further lend it an air of legitimacy at first glance—heightening the risk of successful deception. This domain was flagged by 1 out of 95 VirusTotal security vendors. It resolves to IP address 104.21.80.226 and was registered through Global Domain Group LLC on April 28, 2026. While the domain currently sits at low detection coverage, its active status and hosting configuration suggest ongoing operations. The use of Let’s Encrypt for SSL suggests the threat actors are prioritizing perceived trust, likely to bypass browser warnings and increase engagement. Given the recency of domain registration and the lack of broad blocklisting, this phishing campaign may be in an early or targeted phase. To mitigate risk, users must avoid interacting with fortbox.fun entirely. Organizations should block the domain at DNS and firewall levels, and inspect outbound traffic for connections to 104.21.80.226. Security teams are advised to monitor for related TLS certificate issuance patterns using Let’s Encrypt logs and to warn users about spoofed login prompts. Proactive user awareness training on identifying phishing lures is strongly recommended to reduce the likelihood of credential compromise through this or similar campaigns.