fortine-check[.]xyz

Analysis of fortine-check.xyz indicates a high-risk phishing domain targeting enterprise security credentials. The domain was registered on June 8, 2026, through Global Domain Group LLC, with nameservers hosted by DNSPod (a.dnspod.com, b.dnspod.com, c.dnspod.com). It currently resolves to IP address 85.239.149.81 and remains active as of July 20, 2026. The domain appears on one security blocklist and is flagged by PhishDestroy. VirusTotal detection shows 5 of 95 security vendors marking it as malicious, though the specific detection rules or signatures are not disclosed in available intelligence. Infrastructure review reveals no SSL certificate data or HTTP response details at this time, limiting assessment of encryption or page content. The domain name itself suggests an attempt to impersonate Fortinet, a common enterprise security vendor, though no confirmed brand targeting or phishing kit identification is present in current evidence. The use of 'check' in the domain may indicate a credential verification or login portal theme, a frequent tactic in corporate phishing campaigns. Defenders should treat this domain as active and malicious. Recommended actions include blocking resolution at DNS and firewall levels, monitoring for connections to 85.239.149.81, and alerting users to potential Fortinet-themed credential harvesting attempts. Further analysis of page content and network traffic is advised to confirm the exact phishing mechanism and targeted credentials. No evidence currently links this domain to broader campaign infrastructure or known threat actor groups.